[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

[commit-queue at webkit.org]

The following commit has been merged in the debian/experimental branch:
commit 4bf477ebc2b236eaff3281c16502fe240e403fae
Author: commit-queue at webkit.org <commit-queue at webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Sun Sep 26 21:38:31 2010 +0000

    2010-09-26  Mark Hahnenberg  <mhahnenb at gmail.com>
    
            Reviewed by Oliver Hunt.
    
            valueOf called in wrong order in atan2 and date constructors.
            https://bugs.webkit.org/show_bug.cgi?id=26978
    
            Fixed the bug where the arguments to atan2 were being evaluated
            out of order.
    
            * runtime/MathObject.cpp:
            (JSC::mathProtoFuncATan2):
    2010-09-26  Mark Hahnenberg  <mhahnenb at gmail.com>
    
            Reviewed by Oliver Hunt.
    
            valueOf called in wrong order in atan2 and date constructors.
            https://bugs.webkit.org/show_bug.cgi?id=26978
    
            Regression test for the issue where the arguments to atan2 were
            evaluated out of order.
    
            * fast/js/math-expected.txt:
            * fast/js/script-tests/math.js:
            (v.valueOf):
            (w.valueOf):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@68348 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 32cf06a..f9b158a 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -5,6 +5,19 @@
         valueOf called in wrong order in atan2 and date constructors.
         https://bugs.webkit.org/show_bug.cgi?id=26978
 
+        Fixed the bug where the arguments to atan2 were being evaluated 
+        out of order.
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncATan2):
+
+2010-09-26  Mark Hahnenberg  <mhahnenb at gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        valueOf called in wrong order in atan2 and date constructors.
+        https://bugs.webkit.org/show_bug.cgi?id=26978
+
         Fixed the issue where the parameters to the Date constructor
         were being evaluated to numbers more than once.
 
diff --git a/JavaScriptCore/runtime/MathObject.cpp b/JavaScriptCore/runtime/MathObject.cpp
index 5648264..8d2ae2d 100644
--- a/JavaScriptCore/runtime/MathObject.cpp
+++ b/JavaScriptCore/runtime/MathObject.cpp
@@ -135,7 +135,9 @@ EncodedJSValue JSC_HOST_CALL mathProtoFuncATan(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncATan2(ExecState* exec)
 {
-    return JSValue::encode(jsDoubleNumber(exec, atan2(exec->argument(0).toNumber(exec), exec->argument(1).toNumber(exec))));
+    double arg0 = exec->argument(0).toNumber(exec);
+    double arg1 = exec->argument(1).toNumber(exec);
+    return JSValue::encode(jsDoubleNumber(exec, atan2(arg0, arg1)));
 }
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncCeil(ExecState* exec)
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index de70931..80eb4f6 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -5,6 +5,21 @@
         valueOf called in wrong order in atan2 and date constructors.
         https://bugs.webkit.org/show_bug.cgi?id=26978
 
+        Regression test for the issue where the arguments to atan2 were
+        evaluated out of order.
+
+        * fast/js/math-expected.txt:
+        * fast/js/script-tests/math.js:
+        (v.valueOf):
+        (w.valueOf):
+
+2010-09-26  Mark Hahnenberg  <mhahnenb at gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        valueOf called in wrong order in atan2 and date constructors.
+        https://bugs.webkit.org/show_bug.cgi?id=26978
+
         Added regression test for the Date constructor issue.
 
         * fast/js/date-constructor-expected.txt:
diff --git a/LayoutTests/fast/js/math-expected.txt b/LayoutTests/fast/js/math-expected.txt
index 118432a..89702fc 100644
--- a/LayoutTests/fast/js/math-expected.txt
+++ b/LayoutTests/fast/js/math-expected.txt
@@ -44,6 +44,7 @@ PASS Math.atan2(-0, NaN) is NaN
 PASS Math.atan2(1, NaN) is NaN
 PASS Math.atan2(Infinity, NaN) is NaN
 PASS Math.atan2(-Infinity, NaN) is NaN
+PASS testStr is "onetwo"
 PASS Math.ceil(NaN) is NaN
 PASS Math.ceil(0) is 0
 PASS Math.ceil(-0) is -0
diff --git a/LayoutTests/fast/js/script-tests/math.js b/LayoutTests/fast/js/script-tests/math.js
index 968587a..61ecc68 100644
--- a/LayoutTests/fast/js/script-tests/math.js
+++ b/LayoutTests/fast/js/script-tests/math.js
@@ -50,6 +50,13 @@ shouldBe("Math.atan2(1, NaN)", "NaN");
 shouldBe("Math.atan2(Infinity, NaN)", "NaN");
 shouldBe("Math.atan2(-Infinity, NaN)", "NaN");
 
+// Regression test for Bug 26978 (https://bugs.webkit.org/show_bug.cgi?id=26978)
+var testStr = "";
+var v = { valueOf: function() { testStr += "one"; return 1; } };
+var w = { valueOf: function() { testStr += "two"; return 2; } };
+Math.atan2(v, w);
+shouldBe('testStr', '\"onetwo\"');
+
 /*
 • Ify>0andxis+0, theresult isanimplementation-dependent approximationto +π/2. 
 • Ify>0andxis−0, theresult isanimplementation-dependent approximationto +π/2. 

-- 
WebKit Debian packaging