js/src/jsnum.cpp

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
   2  * vim: set ts=8 sts=4 et sw=4 tw=99:
   3  * This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 /*
   8  * JS number type and wrapper class.
   9  */
  10
  11 #include "jsnum.h"
  12
  13 #include "mozilla/double-conversion.h"
  14 #include "mozilla/FloatingPoint.h"
  15 #include "mozilla/PodOperations.h"
  16 #include "mozilla/RangedPtr.h"
  17
  18 #ifdef HAVE_LOCALECONV
  19 #include <locale.h>
  20 #endif
  21 #include <math.h>
  22 #include <string.h>
  23
  24 #include "jsatom.h"
  25 #include "jscntxt.h"
  26 #include "jsdtoa.h"
  27 #include "jsobj.h"
  28 #include "jsstr.h"
  29 #include "jstypes.h"
  30
  31 #include "js/Conversions.h"
  32 #include "vm/GlobalObject.h"
  33 #include "vm/StringBuffer.h"
  34
  35 #include "jsatominlines.h"
  36
  37 #include "vm/NativeObject-inl.h"
  38 #include "vm/NumberObject-inl.h"
  39 #include "vm/String-inl.h"
  40
  41 using namespace js;
  42 using namespace js::types;
  43
  44 using mozilla::Abs;
  45 using mozilla::ArrayLength;
  46 using mozilla::MinNumberValue;
  47 using mozilla::NegativeInfinity;
  48 using mozilla::PodCopy;
  49 using mozilla::PositiveInfinity;
  50 using mozilla::RangedPtr;
  51
  52 using JS::AutoCheckCannotGC;
  53 using JS::GenericNaN;
  54 using JS::ToInt32;
  55 using JS::ToInt64;
  56 using JS::ToUint32;
  57 using JS::ToUint64;
  58
  59 /*
  60  * If we're accumulating a decimal number and the number is >= 2^53, then the
  61  * fast result from the loop in Get{Prefix,Decimal}Integer may be inaccurate.
  62  * Call js_strtod_harder to get the correct answer.
  63  */
  64 template <typename CharT>
  65 static bool
  66 ComputeAccurateDecimalInteger(ExclusiveContext* cx, const CharT* start, const CharT* end,
  67                               double* dp)
  68 {
  69     size_t length = end - start;
  70     ScopedJSFreePtr<char> cstr(cx->pod_malloc<char>(length + 1));
  71     if (!cstr)
  72         return false;
  73
  74     for (size_t i = 0; i < length; i++) {
  75         char c = char(start[i]);
  76         MOZ_ASSERT(('0' <= c && c <= '9') || ('a' <= c && c <= 'z') || ('A' <= c && c <= 'Z'));
  77         cstr[i] = c;
  78     }
  79     cstr[length] = 0;
  80
  81     char* estr;
  82     int err = 0;
  83     *dp = js_strtod_harder(cx->dtoaState(), cstr, &estr, &err);
  84     if (err == JS_DTOA_ENOMEM) {
  85         js_ReportOutOfMemory(cx);
  86         return false;
  87     }
  88
  89     return true;
  90 }
  91
  92 namespace {
  93
  94 template <typename CharT>
  95 class BinaryDigitReader
  96 {
  97     const int base;      /* Base of number; must be a power of 2 */
  98     int digit;           /* Current digit value in radix given by base */
  99     int digitMask;       /* Mask to extract the next bit from digit */
 100     const CharT* start;  /* Pointer to the remaining digits */
 101     const CharT* end;    /* Pointer to first non-digit */
 102
 103   public:
 104     BinaryDigitReader(int base, const CharT* start, const CharT* end)
 105       : base(base), digit(0), digitMask(0), start(start), end(end)
 106     {
 107     }
 108
 109     /* Return the next binary digit from the number, or -1 if done. */
 110     int nextDigit() {
 111         if (digitMask == 0) {
 112             if (start == end)
 113                 return -1;
 114
 115             int c = *start++;
 116             MOZ_ASSERT(('0' <= c && c <= '9') || ('a' <= c && c <= 'z') || ('A' <= c && c <= 'Z'));
 117             if ('0' <= c && c <= '9')
 118                 digit = c - '0';
 119             else if ('a' <= c && c <= 'z')
 120                 digit = c - 'a' + 10;
 121             else
 122                 digit = c - 'A' + 10;
 123             digitMask = base >> 1;
 124         }
 125
 126         int bit = (digit & digitMask) != 0;
 127         digitMask >>= 1;
 128         return bit;
 129     }
 130 };
 131
 132 } /* anonymous namespace */
 133
 134 /*
 135  * The fast result might also have been inaccurate for power-of-two bases. This
 136  * happens if the addition in value * 2 + digit causes a round-down to an even
 137  * least significant mantissa bit when the first dropped bit is a one.  If any
 138  * of the following digits in the number (which haven't been added in yet) are
 139  * nonzero, then the correct action would have been to round up instead of
 140  * down.  An example occurs when reading the number 0x1000000000000081, which
 141  * rounds to 0x1000000000000000 instead of 0x1000000000000100.
 142  */
 143 template <typename CharT>
 144 static double
 145 ComputeAccurateBinaryBaseInteger(const CharT* start, const CharT* end, int base)
 146 {
 147     BinaryDigitReader<CharT> bdr(base, start, end);
 148
 149     /* Skip leading zeroes. */
 150     int bit;
 151     do {
 152         bit = bdr.nextDigit();
 153     } while (bit == 0);
 154
 155     MOZ_ASSERT(bit == 1); // guaranteed by Get{Prefix,Decimal}Integer
 156
 157     /* Gather the 53 significant bits (including the leading 1). */
 158     double value = 1.0;
 159     for (int j = 52; j > 0; j--) {
 160         bit = bdr.nextDigit();
 161         if (bit < 0)
 162             return value;
 163         value = value * 2 + bit;
 164     }
 165
 166     /* bit2 is the 54th bit (the first dropped from the mantissa). */
 167     int bit2 = bdr.nextDigit();
 168     if (bit2 >= 0) {
 169         double factor = 2.0;
 170         int sticky = 0;  /* sticky is 1 if any bit beyond the 54th is 1 */
 171         int bit3;
 172
 173         while ((bit3 = bdr.nextDigit()) >= 0) {
 174             sticky |= bit3;
 175             factor *= 2;
 176         }
 177         value += bit2 & (bit | sticky);
 178         value *= factor;
 179     }
 180
 181     return value;
 182 }
 183
 184 template <typename CharT>
 185 double
 186 js::ParseDecimalNumber(const mozilla::Range<const CharT> chars)
 187 {
 188     MOZ_ASSERT(chars.length() > 0);
 189     uint64_t dec = 0;
 190     RangedPtr<const CharT> s = chars.start(), end = chars.end();
 191     do {
 192         CharT c = *s;
 193         MOZ_ASSERT('0' <= c && c <= '9');
 194         uint8_t digit = c - '0';
 195         uint64_t next = dec * 10 + digit;
 196         MOZ_ASSERT(next < DOUBLE_INTEGRAL_PRECISION_LIMIT,
 197                    "next value won't be an integrally-precise double");
 198         dec = next;
 199     } while (++s < end);
 200     return static_cast<double>(dec);
 201 }
 202
 203 template double
 204 js::ParseDecimalNumber(const mozilla::Range<const Latin1Char> chars);
 205
 206 template double
 207 js::ParseDecimalNumber(const mozilla::Range<const char16_t> chars);
 208
 209 template <typename CharT>
 210 bool
 211 js::GetPrefixInteger(ExclusiveContext* cx, const CharT* start, const CharT* end, int base,
 212                      const CharT** endp, double* dp)
 213 {
 214     MOZ_ASSERT(start <= end);
 215     MOZ_ASSERT(2 <= base && base <= 36);
 216
 217     const CharT* s = start;
 218     double d = 0.0;
 219     for (; s < end; s++) {
 220         int digit;
 221         CharT c = *s;
 222         if ('0' <= c && c <= '9')
 223             digit = c - '0';
 224         else if ('a' <= c && c <= 'z')
 225             digit = c - 'a' + 10;
 226         else if ('A' <= c && c <= 'Z')
 227             digit = c - 'A' + 10;
 228         else
 229             break;
 230         if (digit >= base)
 231             break;
 232         d = d * base + digit;
 233     }
 234
 235     *endp = s;
 236     *dp = d;
 237
 238     /* If we haven't reached the limit of integer precision, we're done. */
 239     if (d < DOUBLE_INTEGRAL_PRECISION_LIMIT)
 240         return true;
 241
 242     /*
 243      * Otherwise compute the correct integer from the prefix of valid digits
 244      * if we're computing for base ten or a power of two.  Don't worry about
 245      * other bases; see 15.1.2.2 step 13.
 246      */
 247     if (base == 10)
 248         return ComputeAccurateDecimalInteger(cx, start, s, dp);
 249
 250     if ((base & (base - 1)) == 0)
 251         *dp = ComputeAccurateBinaryBaseInteger(start, s, base);
 252
 253     return true;
 254 }
 255
 256 template bool
 257 js::GetPrefixInteger(ExclusiveContext* cx, const char16_t* start, const char16_t* end, int base,
 258                      const char16_t** endp, double* dp);
 259
 260 template bool
 261 js::GetPrefixInteger(ExclusiveContext* cx, const Latin1Char* start, const Latin1Char* end,
 262                      int base, const Latin1Char** endp, double* dp);
 263
 264 bool
 265 js::GetDecimalInteger(ExclusiveContext* cx, const char16_t* start, const char16_t* end, double* dp)
 266 {
 267     MOZ_ASSERT(start <= end);
 268
 269     const char16_t* s = start;
 270     double d = 0.0;
 271     for (; s < end; s++) {
 272         char16_t c = *s;
 273         MOZ_ASSERT('0' <= c && c <= '9');
 274         int digit = c - '0';
 275         d = d * 10 + digit;
 276     }
 277
 278     *dp = d;
 279
 280     // If we haven't reached the limit of integer precision, we're done.
 281     if (d < DOUBLE_INTEGRAL_PRECISION_LIMIT)
 282         return true;
 283
 284     // Otherwise compute the correct integer from the prefix of valid digits.
 285     return ComputeAccurateDecimalInteger(cx, start, s, dp);
 286 }
 287
 288 static bool
 289 num_parseFloat(JSContext* cx, unsigned argc, Value* vp)
 290 {
 291     CallArgs args = CallArgsFromVp(argc, vp);
 292
 293     if (args.length() == 0) {
 294         args.rval().setNaN();
 295         return true;
 296     }
 297
 298     JSString* str = ToString<CanGC>(cx, args[0]);
 299     if (!str)
 300         return false;
 301
 302     JSLinearString* linear = str->ensureLinear(cx);
 303     if (!linear)
 304         return false;
 305
 306     double d;
 307     AutoCheckCannotGC nogc;
 308     if (linear->hasLatin1Chars()) {
 309         const Latin1Char* begin = linear->latin1Chars(nogc);
 310         const Latin1Char* end;
 311         if (!js_strtod(cx, begin, begin + linear->length(), &end, &d))
 312             return false;
 313         if (end == begin)
 314             d = GenericNaN();
 315     } else {
 316         const char16_t* begin = linear->twoByteChars(nogc);
 317         const char16_t* end;
 318         if (!js_strtod(cx, begin, begin + linear->length(), &end, &d))
 319             return false;
 320         if (end == begin)
 321             d = GenericNaN();
 322     }
 323
 324     args.rval().setDouble(d);
 325     return true;
 326 }
 327
 328 template <typename CharT>
 329 static bool
 330 ParseIntImpl(JSContext* cx, const CharT* chars, size_t length, bool stripPrefix, int32_t radix,
 331              double* res)
 332 {
 333     /* Step 2. */
 334     const CharT* end = chars + length;
 335     const CharT* s = SkipSpace(chars, end);
 336
 337     MOZ_ASSERT(chars <= s);
 338     MOZ_ASSERT(s <= end);
 339
 340     /* Steps 3-4. */
 341     bool negative = (s != end && s[0] == '-');
 342
 343     /* Step 5. */
 344     if (s != end && (s[0] == '-' || s[0] == '+'))
 345         s++;
 346
 347     /* Step 10. */
 348     if (stripPrefix) {
 349         if (end - s >= 2 && s[0] == '0' && (s[1] == 'x' || s[1] == 'X')) {
 350             s += 2;
 351             radix = 16;
 352         }
 353     }
 354
 355     /* Steps 11-15. */
 356     const CharT* actualEnd;
 357     double d;
 358     if (!GetPrefixInteger(cx, s, end, radix, &actualEnd, &d))
 359         return false;
 360
 361     if (s == actualEnd)
 362         *res = GenericNaN();
 363     else
 364         *res = negative ? -d : d;
 365     return true;
 366 }
 367
 368 /* ES5 15.1.2.2. */
 369 bool
 370 js::num_parseInt(JSContext* cx, unsigned argc, Value* vp)
 371 {
 372     CallArgs args = CallArgsFromVp(argc, vp);
 373
 374     /* Fast paths and exceptional cases. */
 375     if (args.length() == 0) {
 376         args.rval().setNaN();
 377         return true;
 378     }
 379
 380     if (args.length() == 1 ||
 381         (args[1].isInt32() && (args[1].toInt32() == 0 || args[1].toInt32() == 10))) {
 382         if (args[0].isInt32()) {
 383             args.rval().set(args[0]);
 384             return true;
 385         }
 386
 387         /*
 388          * Step 1 is |inputString = ToString(string)|. When string >=
 389          * 1e21, ToString(string) is in the form "NeM". 'e' marks the end of
 390          * the word, which would mean the result of parseInt(string) should be |N|.
 391          *
 392          * To preserve this behaviour, we can't use the fast-path when string >
 393          * 1e21, or else the result would be |NeM|.
 394          *
 395          * The same goes for values smaller than 1.0e-6, because the string would be in
 396          * the form of "Ne-M".
 397          */
 398         if (args[0].isDouble()) {
 399             double d = args[0].toDouble();
 400             if (1.0e-6 < d && d < 1.0e21) {
 401                 args.rval().setNumber(floor(d));
 402                 return true;
 403             }
 404             if (-1.0e21 < d && d < -1.0e-6) {
 405                 args.rval().setNumber(-floor(-d));
 406                 return true;
 407             }
 408             if (d == 0.0) {
 409                 args.rval().setInt32(0);
 410                 return true;
 411             }
 412         }
 413     }
 414
 415     /* Step 1. */
 416     RootedString inputString(cx, ToString<CanGC>(cx, args[0]));
 417     if (!inputString)
 418         return false;
 419     args[0].setString(inputString);
 420
 421     /* Steps 6-9. */
 422     bool stripPrefix = true;
 423     int32_t radix;
 424     if (!args.hasDefined(1)) {
 425         radix = 10;
 426     } else {
 427         if (!ToInt32(cx, args[1], &radix))
 428             return false;
 429         if (radix == 0) {
 430             radix = 10;
 431         } else {
 432             if (radix < 2 || radix > 36) {
 433                 args.rval().setNaN();
 434                 return true;
 435             }
 436             if (radix != 16)
 437                 stripPrefix = false;
 438         }
 439     }
 440
 441     JSLinearString* linear = inputString->ensureLinear(cx);
 442     if (!linear)
 443         return false;
 444
 445     AutoCheckCannotGC nogc;
 446     size_t length = inputString->length();
 447     double number;
 448     if (linear->hasLatin1Chars()) {
 449         if (!ParseIntImpl(cx, linear->latin1Chars(nogc), length, stripPrefix, radix, &number))
 450             return false;
 451     } else {
 452         if (!ParseIntImpl(cx, linear->twoByteChars(nogc), length, stripPrefix, radix, &number))
 453             return false;
 454     }
 455
 456     args.rval().setNumber(number);
 457     return true;
 458 }
 459
 460 static const JSFunctionSpec number_functions[] = {
 461     JS_SELF_HOSTED_FN(js_isNaN_str, "Global_isNaN", 1,0),
 462     JS_SELF_HOSTED_FN(js_isFinite_str, "Global_isFinite", 1,0),
 463     JS_FN(js_parseFloat_str,    num_parseFloat,      1,0),
 464     JS_FN(js_parseInt_str,      num_parseInt,        2,0),
 465     JS_FS_END
 466 };
 467
 468 const Class NumberObject::class_ = {
 469     js_Number_str,
 470     JSCLASS_HAS_RESERVED_SLOTS(1) | JSCLASS_HAS_CACHED_PROTO(JSProto_Number)
 471 };
 472
 473 static bool
 474 Number(JSContext* cx, unsigned argc, Value* vp)
 475 {
 476     CallArgs args = CallArgsFromVp(argc, vp);
 477
 478     /* Sample JS_CALLEE before clobbering. */
 479     bool isConstructing = args.isConstructing();
 480
 481     if (args.length() > 0) {
 482         if (!ToNumber(cx, args[0]))
 483             return false;
 484         args.rval().set(args[0]);
 485     } else {
 486         args.rval().setInt32(0);
 487     }
 488
 489     if (!isConstructing)
 490         return true;
 491
 492     JSObject* obj = NumberObject::create(cx, args.rval().toNumber());
 493     if (!obj)
 494         return false;
 495     args.rval().setObject(*obj);
 496     return true;
 497 }
 498
 499 MOZ_ALWAYS_INLINE bool
 500 IsNumber(HandleValue v)
 501 {
 502     return v.isNumber() || (v.isObject() && v.toObject().is<NumberObject>());
 503 }
 504
 505 static inline double
 506 Extract(const Value& v)
 507 {
 508     if (v.isNumber())
 509         return v.toNumber();
 510     return v.toObject().as<NumberObject>().unbox();
 511 }
 512
 513 #if JS_HAS_TOSOURCE
 514 MOZ_ALWAYS_INLINE bool
 515 num_toSource_impl(JSContext* cx, CallArgs args)
 516 {
 517     double d = Extract(args.thisv());
 518
 519     StringBuffer sb(cx);
 520     if (!sb.append("(new Number(") ||
 521         !NumberValueToStringBuffer(cx, NumberValue(d), sb) ||
 522         !sb.append("))"))
 523     {
 524         return false;
 525     }
 526
 527     JSString* str = sb.finishString();
 528     if (!str)
 529         return false;
 530     args.rval().setString(str);
 531     return true;
 532 }
 533
 534 static bool
 535 num_toSource(JSContext* cx, unsigned argc, Value* vp)
 536 {
 537     CallArgs args = CallArgsFromVp(argc, vp);
 538     return CallNonGenericMethod<IsNumber, num_toSource_impl>(cx, args);
 539 }
 540 #endif
 541
 542 ToCStringBuf::ToCStringBuf() : dbuf(nullptr)
 543 {
 544     static_assert(sbufSize >= DTOSTR_STANDARD_BUFFER_SIZE,
 545                   "builtin space must be large enough to store even the "
 546                   "longest string produced by a conversion");
 547 }
 548
 549 ToCStringBuf::~ToCStringBuf()
 550 {
 551     js_free(dbuf);
 552 }
 553
 554 MOZ_ALWAYS_INLINE
 555 static JSFlatString*
 556 LookupDtoaCache(ExclusiveContext* cx, double d)
 557 {
 558     if (JSCompartment* comp = cx->compartment()) {
 559         if (JSFlatString* str = comp->dtoaCache.lookup(10, d))
 560             return str;
 561     }
 562
 563     return nullptr;
 564 }
 565
 566 MOZ_ALWAYS_INLINE
 567 static void
 568 CacheNumber(ExclusiveContext* cx, double d, JSFlatString* str)
 569 {
 570     if (JSCompartment* comp = cx->compartment())
 571         comp->dtoaCache.cache(10, d, str);
 572 }
 573
 574 MOZ_ALWAYS_INLINE
 575 static JSFlatString*
 576 LookupInt32ToString(ExclusiveContext* cx, int32_t si)
 577 {
 578     if (si >= 0 && StaticStrings::hasInt(si))
 579         return cx->staticStrings().getInt(si);
 580
 581     return LookupDtoaCache(cx, si);
 582 }
 583
 584 template <typename T>
 585 MOZ_ALWAYS_INLINE
 586 static T*
 587 BackfillInt32InBuffer(int32_t si, T* buffer, size_t size, size_t* length)
 588 {
 589     uint32_t ui = Abs(si);
 590     MOZ_ASSERT_IF(si == INT32_MIN, ui == uint32_t(INT32_MAX) + 1);
 591
 592     RangedPtr<T> end(buffer + size - 1, buffer, size);
 593     *end = '\0';
 594     RangedPtr<T> start = BackfillIndexInCharBuffer(ui, end);
 595     if (si < 0)
 596         *--start = '-';
 597
 598     *length = end - start;
 599     return start.get();
 600 }
 601
 602 template <AllowGC allowGC>
 603 JSFlatString*
 604 js::Int32ToString(ExclusiveContext* cx, int32_t si)
 605 {
 606     if (JSFlatString* str = LookupInt32ToString(cx, si))
 607         return str;
 608
 609     Latin1Char buffer[JSFatInlineString::MAX_LENGTH_LATIN1 + 1];
 610     size_t length;
 611     Latin1Char* start = BackfillInt32InBuffer(si, buffer, ArrayLength(buffer), &length);
 612
 613     mozilla::Range<const Latin1Char> chars(start, length);
 614     JSInlineString* str = NewFatInlineString<allowGC>(cx, chars);
 615     if (!str)
 616         return nullptr;
 617
 618     CacheNumber(cx, si, str);
 619     return str;
 620 }
 621
 622 template JSFlatString*
 623 js::Int32ToString<CanGC>(ExclusiveContext* cx, int32_t si);
 624
 625 template JSFlatString*
 626 js::Int32ToString<NoGC>(ExclusiveContext* cx, int32_t si);
 627
 628 JSAtom*
 629 js::Int32ToAtom(ExclusiveContext* cx, int32_t si)
 630 {
 631     if (JSFlatString* str = LookupInt32ToString(cx, si))
 632         return js::AtomizeString(cx, str);
 633
 634     char buffer[JSFatInlineString::MAX_LENGTH_TWO_BYTE + 1];
 635     size_t length;
 636     char* start = BackfillInt32InBuffer(si, buffer, JSFatInlineString::MAX_LENGTH_TWO_BYTE + 1, &length);
 637
 638     JSAtom* atom = Atomize(cx, start, length);
 639     if (!atom)
 640         return nullptr;
 641
 642     CacheNumber(cx, si, atom);
 643     return atom;
 644 }
 645
 646 /* Returns a non-nullptr pointer to inside cbuf.  */
 647 static char*
 648 Int32ToCString(ToCStringBuf* cbuf, int32_t i, size_t* len, int base = 10)
 649 {
 650     uint32_t u = Abs(i);
 651
 652     RangedPtr<char> cp(cbuf->sbuf + ToCStringBuf::sbufSize - 1, cbuf->sbuf, ToCStringBuf::sbufSize);
 653     char* end = cp.get();
 654     *cp = '\0';
 655
 656     /* Build the string from behind. */
 657     switch (base) {
 658     case 10:
 659       cp = BackfillIndexInCharBuffer(u, cp);
 660       break;
 661     case 16:
 662       do {
 663           unsigned newu = u / 16;
 664           *--cp = "0123456789abcdef"[u - newu * 16];
 665           u = newu;
 666       } while (u != 0);
 667       break;
 668     default:
 669       MOZ_ASSERT(base >= 2 && base <= 36);
 670       do {
 671           unsigned newu = u / base;
 672           *--cp = "0123456789abcdefghijklmnopqrstuvwxyz"[u - newu * base];
 673           u = newu;
 674       } while (u != 0);
 675       break;
 676     }
 677     if (i < 0)
 678         *--cp = '-';
 679
 680     *len = end - cp.get();
 681     return cp.get();
 682 }
 683
 684 template <AllowGC allowGC>
 685 static JSString * JS_FASTCALL
 686 js_NumberToStringWithBase(ExclusiveContext* cx, double d, int base);
 687
 688 MOZ_ALWAYS_INLINE bool
 689 num_toString_impl(JSContext* cx, CallArgs args)
 690 {
 691     MOZ_ASSERT(IsNumber(args.thisv()));
 692
 693     double d = Extract(args.thisv());
 694
 695     int32_t base = 10;
 696     if (args.hasDefined(0)) {
 697         double d2;
 698         if (!ToInteger(cx, args[0], &d2))
 699             return false;
 700
 701         if (d2 < 2 || d2 > 36) {
 702             JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_BAD_RADIX);
 703             return false;
 704         }
 705
 706         base = int32_t(d2);
 707     }
 708     JSString* str = js_NumberToStringWithBase<CanGC>(cx, d, base);
 709     if (!str) {
 710         JS_ReportOutOfMemory(cx);
 711         return false;
 712     }
 713     args.rval().setString(str);
 714     return true;
 715 }
 716
 717 bool
 718 js_num_toString(JSContext* cx, unsigned argc, Value* vp)
 719 {
 720     CallArgs args = CallArgsFromVp(argc, vp);
 721     return CallNonGenericMethod<IsNumber, num_toString_impl>(cx, args);
 722 }
 723
 724 #if !EXPOSE_INTL_API
 725 MOZ_ALWAYS_INLINE bool
 726 num_toLocaleString_impl(JSContext* cx, CallArgs args)
 727 {
 728     MOZ_ASSERT(IsNumber(args.thisv()));
 729
 730     double d = Extract(args.thisv());
 731
 732     Rooted<JSString*> str(cx, js_NumberToStringWithBase<CanGC>(cx, d, 10));
 733     if (!str) {
 734         JS_ReportOutOfMemory(cx);
 735         return false;
 736     }
 737
 738     /*
 739      * Create the string, move back to bytes to make string twiddling
 740      * a bit easier and so we can insert platform charset seperators.
 741      */
 742     JSAutoByteString numBytes(cx, str);
 743     if (!numBytes)
 744         return false;
 745     const char* num = numBytes.ptr();
 746     if (!num)
 747         return false;
 748
 749     /*
 750      * Find the first non-integer value, whether it be a letter as in
 751      * 'Infinity', a decimal point, or an 'e' from exponential notation.
 752      */
 753     const char* nint = num;
 754     if (*nint == '-')
 755         nint++;
 756     while (*nint >= '0' && *nint <= '9')
 757         nint++;
 758     int digits = nint - num;
 759     const char* end = num + digits;
 760     if (!digits) {
 761         args.rval().setString(str);
 762         return true;
 763     }
 764
 765     JSRuntime* rt = cx->runtime();
 766     size_t thousandsLength = strlen(rt->thousandsSeparator);
 767     size_t decimalLength = strlen(rt->decimalSeparator);
 768
 769     /* Figure out how long resulting string will be. */
 770     int buflen = strlen(num);
 771     if (*nint == '.')
 772         buflen += decimalLength - 1; /* -1 to account for existing '.' */
 773
 774     const char* numGrouping;
 775     const char* tmpGroup;
 776     numGrouping = tmpGroup = rt->numGrouping;
 777     int remainder = digits;
 778     if (*num == '-')
 779         remainder--;
 780
 781     while (*tmpGroup != CHAR_MAX && *tmpGroup != '\0') {
 782         if (*tmpGroup >= remainder)
 783             break;
 784         buflen += thousandsLength;
 785         remainder -= *tmpGroup;
 786         tmpGroup++;
 787     }
 788
 789     int nrepeat;
 790     if (*tmpGroup == '\0' && *numGrouping != '\0') {
 791         nrepeat = (remainder - 1) / tmpGroup[-1];
 792         buflen += thousandsLength * nrepeat;
 793         remainder -= nrepeat * tmpGroup[-1];
 794     } else {
 795         nrepeat = 0;
 796     }
 797     tmpGroup--;
 798
 799     char* buf = cx->pod_malloc<char>(buflen + 1);
 800     if (!buf)
 801         return false;
 802
 803     char* tmpDest = buf;
 804     const char* tmpSrc = num;
 805
 806     while (*tmpSrc == '-' || remainder--) {
 807         MOZ_ASSERT(tmpDest - buf < buflen);
 808         *tmpDest++ = *tmpSrc++;
 809     }
 810     while (tmpSrc < end) {
 811         MOZ_ASSERT(tmpDest - buf + ptrdiff_t(thousandsLength) <= buflen);
 812         strcpy(tmpDest, rt->thousandsSeparator);
 813         tmpDest += thousandsLength;
 814         MOZ_ASSERT(tmpDest - buf + *tmpGroup <= buflen);
 815         js_memcpy(tmpDest, tmpSrc, *tmpGroup);
 816         tmpDest += *tmpGroup;
 817         tmpSrc += *tmpGroup;
 818         if (--nrepeat < 0)
 819             tmpGroup--;
 820     }
 821
 822     if (*nint == '.') {
 823         MOZ_ASSERT(tmpDest - buf + ptrdiff_t(decimalLength) <= buflen);
 824         strcpy(tmpDest, rt->decimalSeparator);
 825         tmpDest += decimalLength;
 826         MOZ_ASSERT(tmpDest - buf + ptrdiff_t(strlen(nint + 1)) <= buflen);
 827         strcpy(tmpDest, nint + 1);
 828     } else {
 829         MOZ_ASSERT(tmpDest - buf + ptrdiff_t(strlen(nint)) <= buflen);
 830         strcpy(tmpDest, nint);
 831     }
 832
 833     if (cx->runtime()->localeCallbacks && cx->runtime()->localeCallbacks->localeToUnicode) {
 834         Rooted<Value> v(cx, StringValue(str));
 835         bool ok = !!cx->runtime()->localeCallbacks->localeToUnicode(cx, buf, &v);
 836         if (ok)
 837             args.rval().set(v);
 838         js_free(buf);
 839         return ok;
 840     }
 841
 842     str = NewStringCopyN<CanGC>(cx, buf, buflen);
 843     js_free(buf);
 844     if (!str)
 845         return false;
 846
 847     args.rval().setString(str);
 848     return true;
 849 }
 850
 851 static bool
 852 num_toLocaleString(JSContext* cx, unsigned argc, Value* vp)
 853 {
 854     CallArgs args = CallArgsFromVp(argc, vp);
 855     return CallNonGenericMethod<IsNumber, num_toLocaleString_impl>(cx, args);
 856 }
 857 #endif /* !EXPOSE_INTL_API */
 858
 859 MOZ_ALWAYS_INLINE bool
 860 num_valueOf_impl(JSContext* cx, CallArgs args)
 861 {
 862     MOZ_ASSERT(IsNumber(args.thisv()));
 863     args.rval().setNumber(Extract(args.thisv()));
 864     return true;
 865 }
 866
 867 bool
 868 js_num_valueOf(JSContext* cx, unsigned argc, Value* vp)
 869 {
 870     CallArgs args = CallArgsFromVp(argc, vp);
 871     return CallNonGenericMethod<IsNumber, num_valueOf_impl>(cx, args);
 872 }
 873
 874 static const unsigned MAX_PRECISION = 100;
 875
 876 static bool
 877 ComputePrecisionInRange(JSContext* cx, int minPrecision, int maxPrecision, HandleValue v,
 878                         int* precision)
 879 {
 880     double prec;
 881     if (!ToInteger(cx, v, &prec))
 882         return false;
 883     if (minPrecision <= prec && prec <= maxPrecision) {
 884         *precision = int(prec);
 885         return true;
 886     }
 887
 888     ToCStringBuf cbuf;
 889     if (char* numStr = NumberToCString(cx, &cbuf, prec, 10))
 890         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_PRECISION_RANGE, numStr);
 891     return false;
 892 }
 893
 894 static bool
 895 DToStrResult(JSContext* cx, double d, JSDToStrMode mode, int precision, CallArgs args)
 896 {
 897     char buf[DTOSTR_VARIABLE_BUFFER_SIZE(MAX_PRECISION + 1)];
 898     char* numStr = js_dtostr(cx->mainThread().dtoaState, buf, sizeof buf, mode, precision, d);
 899     if (!numStr) {
 900         JS_ReportOutOfMemory(cx);
 901         return false;
 902     }
 903     JSString* str = NewStringCopyZ<CanGC>(cx, numStr);
 904     if (!str)
 905         return false;
 906     args.rval().setString(str);
 907     return true;
 908 }
 909
 910 /*
 911  * In the following three implementations, we allow a larger range of precision
 912  * than ECMA requires; this is permitted by ECMA-262.
 913  */
 914 MOZ_ALWAYS_INLINE bool
 915 num_toFixed_impl(JSContext* cx, CallArgs args)
 916 {
 917     MOZ_ASSERT(IsNumber(args.thisv()));
 918
 919     int precision;
 920     if (args.length() == 0) {
 921         precision = 0;
 922     } else {
 923         if (!ComputePrecisionInRange(cx, -20, MAX_PRECISION, args[0], &precision))
 924             return false;
 925     }
 926
 927     return DToStrResult(cx, Extract(args.thisv()), DTOSTR_FIXED, precision, args);
 928 }
 929
 930 static bool
 931 num_toFixed(JSContext* cx, unsigned argc, Value* vp)
 932 {
 933     CallArgs args = CallArgsFromVp(argc, vp);
 934     return CallNonGenericMethod<IsNumber, num_toFixed_impl>(cx, args);
 935 }
 936
 937 MOZ_ALWAYS_INLINE bool
 938 num_toExponential_impl(JSContext* cx, CallArgs args)
 939 {
 940     MOZ_ASSERT(IsNumber(args.thisv()));
 941
 942     JSDToStrMode mode;
 943     int precision;
 944     if (!args.hasDefined(0)) {
 945         mode = DTOSTR_STANDARD_EXPONENTIAL;
 946         precision = 0;
 947     } else {
 948         mode = DTOSTR_EXPONENTIAL;
 949         if (!ComputePrecisionInRange(cx, 0, MAX_PRECISION, args[0], &precision))
 950             return false;
 951     }
 952
 953     return DToStrResult(cx, Extract(args.thisv()), mode, precision + 1, args);
 954 }
 955
 956 static bool
 957 num_toExponential(JSContext* cx, unsigned argc, Value* vp)
 958 {
 959     CallArgs args = CallArgsFromVp(argc, vp);
 960     return CallNonGenericMethod<IsNumber, num_toExponential_impl>(cx, args);
 961 }
 962
 963 MOZ_ALWAYS_INLINE bool
 964 num_toPrecision_impl(JSContext* cx, CallArgs args)
 965 {
 966     MOZ_ASSERT(IsNumber(args.thisv()));
 967
 968     double d = Extract(args.thisv());
 969
 970     if (!args.hasDefined(0)) {
 971         JSString* str = js_NumberToStringWithBase<CanGC>(cx, d, 10);
 972         if (!str) {
 973             JS_ReportOutOfMemory(cx);
 974             return false;
 975         }
 976         args.rval().setString(str);
 977         return true;
 978     }
 979
 980     int precision;
 981     if (!ComputePrecisionInRange(cx, 1, MAX_PRECISION, args[0], &precision))
 982         return false;
 983
 984     return DToStrResult(cx, d, DTOSTR_PRECISION, precision, args);
 985 }
 986
 987 static bool
 988 num_toPrecision(JSContext* cx, unsigned argc, Value* vp)
 989 {
 990     CallArgs args = CallArgsFromVp(argc, vp);
 991     return CallNonGenericMethod<IsNumber, num_toPrecision_impl>(cx, args);
 992 }
 993
 994 static const JSFunctionSpec number_methods[] = {
 995 #if JS_HAS_TOSOURCE
 996     JS_FN(js_toSource_str,       num_toSource,          0, 0),
 997 #endif
 998     JS_FN(js_toString_str,       js_num_toString,       1, 0),
 999 #if EXPOSE_INTL_API
1000     JS_SELF_HOSTED_FN(js_toLocaleString_str, "Number_toLocaleString", 0,0),
1001 #else
1002     JS_FN(js_toLocaleString_str, num_toLocaleString,     0,0),
1003 #endif
1004     JS_FN(js_valueOf_str,        js_num_valueOf,        0, 0),
1005     JS_FN("toFixed",             num_toFixed,           1, 0),
1006     JS_FN("toExponential",       num_toExponential,     1, 0),
1007     JS_FN("toPrecision",         num_toPrecision,       1, 0),
1008     JS_FS_END
1009 };
1010
1011 // ES6 draft ES6 15.7.3.12
1012 static bool
1013 Number_isInteger(JSContext* cx, unsigned argc, Value* vp)
1014 {
1015     CallArgs args = CallArgsFromVp(argc, vp);
1016     if (args.length() < 1 || !args[0].isNumber()) {
1017         args.rval().setBoolean(false);
1018         return true;
1019     }
1020     Value val = args[0];
1021     args.rval().setBoolean(val.isInt32() ||
1022                            (mozilla::IsFinite(val.toDouble()) &&
1023                             JS::ToInteger(val.toDouble()) == val.toDouble()));
1024     return true;
1025 }
1026
1027
1028 static const JSFunctionSpec number_static_methods[] = {
1029     JS_SELF_HOSTED_FN("isFinite", "Number_isFinite", 1,0),
1030     JS_FN("isInteger", Number_isInteger, 1, 0),
1031     JS_SELF_HOSTED_FN("isNaN", "Number_isNaN", 1,0),
1032     JS_SELF_HOSTED_FN("isSafeInteger", "Number_isSafeInteger", 1,0),
1033     JS_FN("parseFloat", num_parseFloat, 1, 0),
1034     JS_FN("parseInt", num_parseInt, 2, 0),
1035     JS_FS_END
1036 };
1037
1038
1039 /* NB: Keep this in synch with number_constants[]. */
1040 enum nc_slot {
1041     NC_NaN,
1042     NC_POSITIVE_INFINITY,
1043     NC_NEGATIVE_INFINITY,
1044     NC_MAX_VALUE,
1045     NC_MIN_VALUE,
1046     NC_MAX_SAFE_INTEGER,
1047     NC_MIN_SAFE_INTEGER,
1048     NC_EPSILON,
1049     NC_LIMIT
1050 };
1051
1052 /*
1053  * Some to most C compilers forbid spelling these at compile time, or barf
1054  * if you try, so all but MAX_VALUE are set up by InitRuntimeNumberState
1055  * using union jsdpun.
1056  */
1057 static JSConstDoubleSpec number_constants[] = {
1058     {"NaN",               0                          },
1059     {"POSITIVE_INFINITY", 0                          },
1060     {"NEGATIVE_INFINITY", 0                          },
1061     {"MAX_VALUE",         1.7976931348623157E+308    },
1062     {"MIN_VALUE",         0                          },
1063     /* ES6 (April 2014 draft) 20.1.2.6 */
1064     {"MAX_SAFE_INTEGER",  9007199254740991           },
1065     /* ES6 (April 2014 draft) 20.1.2.10 */
1066     {"MIN_SAFE_INTEGER", -9007199254740991,          },
1067     /* ES6 (May 2013 draft) 15.7.3.7 */
1068     {"EPSILON", 2.2204460492503130808472633361816e-16},
1069     {0,0}
1070 };
1071
1072 /*
1073  * Set the exception mask to mask all exceptions and set the FPU precision
1074  * to 53 bit mantissa (64 bit doubles).
1075  */
1076 void
1077 js::FIX_FPU()
1078 {
1079 #if (defined __GNUC__ && defined __i386__) || \
1080     (defined __SUNPRO_CC && defined __i386)
1081     short control;
1082     asm("fstcw %0" : "=m" (control) : );
1083     control &= ~0x300; // Lower bits 8 and 9 (precision control).
1084     control |= 0x2f3;  // Raise bits 0-5 (exception masks) and 9 (64-bit precision).
1085     asm("fldcw %0" : : "m" (control) );
1086 #endif
1087 }
1088
1089 bool
1090 js::InitRuntimeNumberState(JSRuntime* rt)
1091 {
1092     FIX_FPU();
1093
1094     /*
1095      * Our NaN must be one particular canonical value, because we rely on NaN
1096      * encoding for our value representation.  See Value.h.
1097      */
1098     number_constants[NC_NaN].val = GenericNaN();
1099
1100     number_constants[NC_POSITIVE_INFINITY].val = mozilla::PositiveInfinity<double>();
1101     number_constants[NC_NEGATIVE_INFINITY].val = mozilla::NegativeInfinity<double>();
1102
1103     number_constants[NC_MIN_VALUE].val = MinNumberValue<double>();
1104
1105     // XXX If EXPOSE_INTL_API becomes true all the time at some point,
1106     //     js::InitRuntimeNumberState is no longer fallible, and we should
1107     //     change its return type.
1108 #if !EXPOSE_INTL_API
1109     /* Copy locale-specific separators into the runtime strings. */
1110     const char* thousandsSeparator, *decimalPoint, *grouping;
1111 #ifdef HAVE_LOCALECONV
1112     struct lconv* locale = localeconv();
1113     thousandsSeparator = locale->thousands_sep;
1114     decimalPoint = locale->decimal_point;
1115     grouping = locale->grouping;
1116 #else
1117     thousandsSeparator = getenv("LOCALE_THOUSANDS_SEP");
1118     decimalPoint = getenv("LOCALE_DECIMAL_POINT");
1119     grouping = getenv("LOCALE_GROUPING");
1120 #endif
1121     if (!thousandsSeparator)
1122         thousandsSeparator = "'";
1123     if (!decimalPoint)
1124         decimalPoint = ".";
1125     if (!grouping)
1126         grouping = "\3\0";
1127
1128     /*
1129      * We use single malloc to get the memory for all separator and grouping
1130      * strings.
1131      */
1132     size_t thousandsSeparatorSize = strlen(thousandsSeparator) + 1;
1133     size_t decimalPointSize = strlen(decimalPoint) + 1;
1134     size_t groupingSize = strlen(grouping) + 1;
1135
1136     char* storage = js_pod_malloc<char>(thousandsSeparatorSize +
1137                                         decimalPointSize +
1138                                         groupingSize);
1139     if (!storage)
1140         return false;
1141
1142     js_memcpy(storage, thousandsSeparator, thousandsSeparatorSize);
1143     rt->thousandsSeparator = storage;
1144     storage += thousandsSeparatorSize;
1145
1146     js_memcpy(storage, decimalPoint, decimalPointSize);
1147     rt->decimalSeparator = storage;
1148     storage += decimalPointSize;
1149
1150     js_memcpy(storage, grouping, groupingSize);
1151     rt->numGrouping = grouping;
1152 #endif /* !EXPOSE_INTL_API */
1153     return true;
1154 }
1155
1156 #if !EXPOSE_INTL_API
1157 void
1158 js::FinishRuntimeNumberState(JSRuntime* rt)
1159 {
1160     /*
1161      * The free also releases the memory for decimalSeparator and numGrouping
1162      * strings.
1163      */
1164     char* storage = const_cast<char*>(rt->thousandsSeparator);
1165     js_free(storage);
1166 }
1167 #endif
1168
1169 JSObject*
1170 js_InitNumberClass(JSContext* cx, HandleObject obj)
1171 {
1172     MOZ_ASSERT(obj->isNative());
1173
1174     /* XXX must do at least once per new thread, so do it per JSContext... */
1175     FIX_FPU();
1176
1177     Rooted<GlobalObject*> global(cx, &obj->as<GlobalObject>());
1178
1179     RootedObject numberProto(cx, global->createBlankPrototype(cx, &NumberObject::class_));
1180     if (!numberProto)
1181         return nullptr;
1182     numberProto->as<NumberObject>().setPrimitiveValue(0);
1183
1184     RootedFunction ctor(cx);
1185     ctor = global->createConstructor(cx, Number, cx->names().Number, 1);
1186     if (!ctor)
1187         return nullptr;
1188
1189     if (!LinkConstructorAndPrototype(cx, ctor, numberProto))
1190         return nullptr;
1191
1192     /* Add numeric constants (MAX_VALUE, NaN, &c.) to the Number constructor. */
1193     if (!JS_DefineConstDoubles(cx, ctor, number_constants))
1194         return nullptr;
1195
1196     if (!DefinePropertiesAndFunctions(cx, ctor, nullptr, number_static_methods))
1197         return nullptr;
1198
1199     if (!DefinePropertiesAndFunctions(cx, numberProto, nullptr, number_methods))
1200         return nullptr;
1201
1202     if (!JS_DefineFunctions(cx, global, number_functions))
1203         return nullptr;
1204
1205     RootedValue valueNaN(cx, cx->runtime()->NaNValue);
1206     RootedValue valueInfinity(cx, cx->runtime()->positiveInfinityValue);
1207
1208     /* ES5 15.1.1.1, 15.1.1.2 */
1209     if (!DefineNativeProperty(cx, global, cx->names().NaN, valueNaN, nullptr, nullptr,
1210                               JSPROP_PERMANENT | JSPROP_READONLY) ||
1211         !DefineNativeProperty(cx, global, cx->names().Infinity, valueInfinity, nullptr, nullptr,
1212                               JSPROP_PERMANENT | JSPROP_READONLY))
1213     {
1214         return nullptr;
1215     }
1216
1217     if (!GlobalObject::initBuiltinConstructor(cx, global, JSProto_Number, ctor, numberProto))
1218         return nullptr;
1219
1220     return numberProto;
1221 }
1222
1223 static char*
1224 FracNumberToCString(ExclusiveContext* cx, ToCStringBuf* cbuf, double d, int base = 10)
1225 {
1226 #ifdef DEBUG
1227     {
1228         int32_t _;
1229         MOZ_ASSERT(!mozilla::NumberIsInt32(d, &_));
1230     }
1231 #endif
1232
1233     char* numStr;
1234     if (base == 10) {
1235         /*
1236          * This is V8's implementation of the algorithm described in the
1237          * following paper:
1238          *
1239          *   Printing floating-point numbers quickly and accurately with integers.
1240          *   Florian Loitsch, PLDI 2010.
1241          */
1242         const double_conversion::DoubleToStringConverter& converter
1243             = double_conversion::DoubleToStringConverter::EcmaScriptConverter();
1244         double_conversion::StringBuilder builder(cbuf->sbuf, cbuf->sbufSize);
1245         converter.ToShortest(d, &builder);
1246         numStr = builder.Finalize();
1247     } else {
1248         numStr = cbuf->dbuf = js_dtobasestr(cx->dtoaState(), base, d);
1249     }
1250     return numStr;
1251 }
1252
1253 char*
1254 js::NumberToCString(JSContext* cx, ToCStringBuf* cbuf, double d, int base/* = 10*/)
1255 {
1256     int32_t i;
1257     size_t len;
1258     return mozilla::NumberIsInt32(d, &i)
1259            ? Int32ToCString(cbuf, i, &len, base)
1260            : FracNumberToCString(cx, cbuf, d, base);
1261 }
1262
1263 template <AllowGC allowGC>
1264 static JSString * JS_FASTCALL
1265 js_NumberToStringWithBase(ExclusiveContext* cx, double d, int base)
1266 {
1267     ToCStringBuf cbuf;
1268     char* numStr;
1269
1270     /*
1271      * Caller is responsible for error reporting. When called from trace,
1272      * returning nullptr here will cause us to fall of trace and then retry
1273      * from the interpreter (which will report the error).
1274      */
1275     if (base < 2 || base > 36)
1276         return nullptr;
1277
1278     JSCompartment* comp = cx->compartment();
1279
1280     int32_t i;
1281     if (mozilla::NumberIsInt32(d, &i)) {
1282         if (base == 10 && StaticStrings::hasInt(i))
1283             return cx->staticStrings().getInt(i);
1284         if (unsigned(i) < unsigned(base)) {
1285             if (i < 10)
1286                 return cx->staticStrings().getInt(i);
1287             char16_t c = 'a' + i - 10;
1288             MOZ_ASSERT(StaticStrings::hasUnit(c));
1289             return cx->staticStrings().getUnit(c);
1290         }
1291
1292         if (JSFlatString* str = comp->dtoaCache.lookup(base, d))
1293             return str;
1294
1295         size_t len;
1296         numStr = Int32ToCString(&cbuf, i, &len, base);
1297         MOZ_ASSERT(!cbuf.dbuf && numStr >= cbuf.sbuf && numStr < cbuf.sbuf + cbuf.sbufSize);
1298     } else {
1299         if (JSFlatString* str = comp->dtoaCache.lookup(base, d))
1300             return str;
1301
1302         numStr = FracNumberToCString(cx, &cbuf, d, base);
1303         if (!numStr) {
1304             js_ReportOutOfMemory(cx);
1305             return nullptr;
1306         }
1307         MOZ_ASSERT_IF(base == 10,
1308                       !cbuf.dbuf && numStr >= cbuf.sbuf && numStr < cbuf.sbuf + cbuf.sbufSize);
1309         MOZ_ASSERT_IF(base != 10,
1310                       cbuf.dbuf && cbuf.dbuf == numStr);
1311     }
1312
1313     JSFlatString* s = NewStringCopyZ<allowGC>(cx, numStr);
1314
1315     comp->dtoaCache.cache(base, d, s);
1316     return s;
1317 }
1318
1319 template <AllowGC allowGC>
1320 JSString*
1321 js::NumberToString(ExclusiveContext* cx, double d)
1322 {
1323     return js_NumberToStringWithBase<allowGC>(cx, d, 10);
1324 }
1325
1326 template JSString*
1327 js::NumberToString<CanGC>(ExclusiveContext* cx, double d);
1328
1329 template JSString*
1330 js::NumberToString<NoGC>(ExclusiveContext* cx, double d);
1331
1332 JSAtom*
1333 js::NumberToAtom(ExclusiveContext* cx, double d)
1334 {
1335     int32_t si;
1336     if (mozilla::NumberIsInt32(d, &si))
1337         return Int32ToAtom(cx, si);
1338
1339     if (JSFlatString* str = LookupDtoaCache(cx, d))
1340         return AtomizeString(cx, str);
1341
1342     ToCStringBuf cbuf;
1343     char* numStr = FracNumberToCString(cx, &cbuf, d);
1344     if (!numStr) {
1345         js_ReportOutOfMemory(cx);
1346         return nullptr;
1347     }
1348     MOZ_ASSERT(!cbuf.dbuf && numStr >= cbuf.sbuf && numStr < cbuf.sbuf + cbuf.sbufSize);
1349
1350     size_t length = strlen(numStr);
1351     JSAtom* atom = Atomize(cx, numStr, length);
1352     if (!atom)
1353         return nullptr;
1354
1355     CacheNumber(cx, d, atom);
1356
1357     return atom;
1358 }
1359
1360 JSFlatString*
1361 js::NumberToString(JSContext* cx, double d)
1362 {
1363     if (JSString* str = js_NumberToStringWithBase<CanGC>(cx, d, 10))
1364         return &str->asFlat();
1365     return nullptr;
1366 }
1367
1368 JSFlatString*
1369 js::IndexToString(JSContext* cx, uint32_t index)
1370 {
1371     if (StaticStrings::hasUint(index))
1372         return cx->staticStrings().getUint(index);
1373
1374     JSCompartment* c = cx->compartment();
1375     if (JSFlatString* str = c->dtoaCache.lookup(10, index))
1376         return str;
1377
1378     Latin1Char buffer[JSFatInlineString::MAX_LENGTH_LATIN1 + 1];
1379     RangedPtr<Latin1Char> end(buffer + JSFatInlineString::MAX_LENGTH_LATIN1,
1380                               buffer, JSFatInlineString::MAX_LENGTH_LATIN1 + 1);
1381     *end = '\0';
1382     RangedPtr<Latin1Char> start = BackfillIndexInCharBuffer(index, end);
1383
1384     mozilla::Range<const Latin1Char> chars(start.get(), end - start);
1385     JSInlineString* str = NewFatInlineString<CanGC>(cx, chars);
1386     if (!str)
1387         return nullptr;
1388
1389     c->dtoaCache.cache(10, index, str);
1390     return str;
1391 }
1392
1393 bool JS_FASTCALL
1394 js::NumberValueToStringBuffer(JSContext* cx, const Value& v, StringBuffer& sb)
1395 {
1396     /* Convert to C-string. */
1397     ToCStringBuf cbuf;
1398     const char* cstr;
1399     size_t cstrlen;
1400     if (v.isInt32()) {
1401         cstr = Int32ToCString(&cbuf, v.toInt32(), &cstrlen);
1402         MOZ_ASSERT(cstrlen == strlen(cstr));
1403     } else {
1404         cstr = NumberToCString(cx, &cbuf, v.toDouble());
1405         if (!cstr) {
1406             JS_ReportOutOfMemory(cx);
1407             return false;
1408         }
1409         cstrlen = strlen(cstr);
1410     }
1411
1412     /*
1413      * Inflate to char16_t string.  The input C-string characters are < 127, so
1414      * even if char16_t units are UTF-8, all chars should map to one char16_t.
1415      */
1416     MOZ_ASSERT(!cbuf.dbuf && cstrlen < cbuf.sbufSize);
1417     return sb.append(cstr, cstrlen);
1418 }
1419
1420 template <typename CharT>
1421 static bool
1422 CharsToNumber(ExclusiveContext* cx, const CharT* chars, size_t length, double* result)
1423 {
1424     if (length == 1) {
1425         CharT c = chars[0];
1426         if ('0' <= c && c <= '9')
1427             *result = c - '0';
1428         else if (unicode::IsSpace(c))
1429             *result = 0.0;
1430         else
1431             *result = GenericNaN();
1432         return true;
1433     }
1434
1435     const CharT* end = chars + length;
1436     const CharT* bp = SkipSpace(chars, end);
1437
1438     /* ECMA doesn't allow signed non-decimal numbers (bug 273467). */
1439     if (end - bp >= 2 && bp[0] == '0') {
1440         int radix = 0;
1441         if (bp[1] == 'b' || bp[1] == 'B')
1442             radix = 2;
1443         else if (bp[1] == 'o' || bp[1] == 'O')
1444             radix = 8;
1445         else if (bp[1] == 'x' || bp[1] == 'X')
1446             radix = 16;
1447
1448         if (radix != 0) {
1449             /*
1450              * It's probably a non-decimal number. Accept if there's at least one digit after
1451              * the 0b|0o|0x, and if no non-whitespace characters follow all the digits.
1452              */
1453             const CharT* endptr;
1454             double d;
1455             if (!GetPrefixInteger(cx, bp + 2, end, radix, &endptr, &d) ||
1456                 endptr == bp + 2 ||
1457                 SkipSpace(endptr, end) != end)
1458             {
1459                 *result = GenericNaN();
1460             } else {
1461                 *result = d;
1462             }
1463             return true;
1464         }
1465     }
1466
1467     /*
1468      * Note that ECMA doesn't treat a string beginning with a '0' as
1469      * an octal number here. This works because all such numbers will
1470      * be interpreted as decimal by js_strtod.  Also, any hex numbers
1471      * that have made it here (which can only be negative ones) will
1472      * be treated as 0 without consuming the 'x' by js_strtod.
1473      */
1474     const CharT* ep;
1475     double d;
1476     if (!js_strtod(cx, bp, end, &ep, &d)) {
1477         *result = GenericNaN();
1478         return false;
1479     }
1480
1481     if (SkipSpace(ep, end) != end)
1482         *result = GenericNaN();
1483     else
1484         *result = d;
1485
1486     return true;
1487 }
1488
1489 bool
1490 js::StringToNumber(ExclusiveContext* cx, JSString* str, double* result)
1491 {
1492     AutoCheckCannotGC nogc;
1493     JSLinearString* linearStr = str->ensureLinear(cx);
1494     if (!linearStr)
1495         return false;
1496
1497     return linearStr->hasLatin1Chars()
1498            ? CharsToNumber(cx, linearStr->latin1Chars(nogc), str->length(), result)
1499            : CharsToNumber(cx, linearStr->twoByteChars(nogc), str->length(), result);
1500 }
1501
1502 bool
1503 js::ToNumberSlow(ExclusiveContext* cx, Value v, double* out)
1504 {
1505     MOZ_ASSERT(!v.isNumber());
1506     goto skip_int_double;
1507     for (;;) {
1508         if (v.isNumber()) {
1509             *out = v.toNumber();
1510             return true;
1511         }
1512
1513       skip_int_double:
1514         if (!v.isObject()) {
1515             if (v.isString())
1516                 return StringToNumber(cx, v.toString(), out);
1517             if (v.isBoolean()) {
1518                 *out = v.toBoolean() ? 1.0 : 0.0;
1519                 return true;
1520             }
1521             if (v.isNull()) {
1522                 *out = 0.0;
1523                 return true;
1524             }
1525             if (v.isSymbol()) {
1526                 if (cx->isJSContext()) {
1527                     JS_ReportErrorNumber(cx->asJSContext(), js_GetErrorMessage, nullptr,
1528                                          JSMSG_SYMBOL_TO_NUMBER);
1529                 }
1530                 return false;
1531             }
1532
1533             MOZ_ASSERT(v.isUndefined());
1534             *out = GenericNaN();
1535             return true;
1536         }
1537
1538         if (!cx->isJSContext())
1539             return false;
1540
1541         RootedValue v2(cx, v);
1542         if (!ToPrimitive(cx->asJSContext(), JSTYPE_NUMBER, &v2))
1543             return false;
1544         v = v2;
1545         if (v.isObject())
1546             break;
1547     }
1548
1549     *out = GenericNaN();
1550     return true;
1551 }
1552
1553 JS_PUBLIC_API(bool)
1554 js::ToNumberSlow(JSContext* cx, Value v, double* out)
1555 {
1556     return ToNumberSlow(static_cast<ExclusiveContext*>(cx), v, out);
1557 }
1558
1559 /*
1560  * Convert a value to an int64_t, according to the WebIDL rules for long long
1561  * conversion. Return converted value in *out on success, false on failure.
1562  */
1563 JS_PUBLIC_API(bool)
1564 js::ToInt64Slow(JSContext* cx, const HandleValue v, int64_t* out)
1565 {
1566     MOZ_ASSERT(!v.isInt32());
1567     double d;
1568     if (v.isDouble()) {
1569         d = v.toDouble();
1570     } else {
1571         if (!ToNumberSlow(cx, v, &d))
1572             return false;
1573     }
1574     *out = ToInt64(d);
1575     return true;
1576 }
1577
1578 /*
1579  * Convert a value to an uint64_t, according to the WebIDL rules for unsigned long long
1580  * conversion. Return converted value in *out on success, false on failure.
1581  */
1582 JS_PUBLIC_API(bool)
1583 js::ToUint64Slow(JSContext* cx, const HandleValue v, uint64_t* out)
1584 {
1585     MOZ_ASSERT(!v.isInt32());
1586     double d;
1587     if (v.isDouble()) {
1588         d = v.toDouble();
1589     } else {
1590         if (!ToNumberSlow(cx, v, &d))
1591             return false;
1592     }
1593     *out = ToUint64(d);
1594     return true;
1595 }
1596
1597 JS_PUBLIC_API(bool)
1598 js::ToInt32Slow(JSContext* cx, const HandleValue v, int32_t* out)
1599 {
1600     MOZ_ASSERT(!v.isInt32());
1601     double d;
1602     if (v.isDouble()) {
1603         d = v.toDouble();
1604     } else {
1605         if (!ToNumberSlow(cx, v, &d))
1606             return false;
1607     }
1608     *out = ToInt32(d);
1609     return true;
1610 }
1611
1612 JS_PUBLIC_API(bool)
1613 js::ToUint32Slow(JSContext* cx, const HandleValue v, uint32_t* out)
1614 {
1615     MOZ_ASSERT(!v.isInt32());
1616     double d;
1617     if (v.isDouble()) {
1618         d = v.toDouble();
1619     } else {
1620         if (!ToNumberSlow(cx, v, &d))
1621             return false;
1622     }
1623     *out = ToUint32(d);
1624     return true;
1625 }
1626
1627 JS_PUBLIC_API(bool)
1628 js::ToUint16Slow(JSContext* cx, const HandleValue v, uint16_t* out)
1629 {
1630     MOZ_ASSERT(!v.isInt32());
1631     double d;
1632     if (v.isDouble()) {
1633         d = v.toDouble();
1634     } else if (!ToNumberSlow(cx, v, &d)) {
1635         return false;
1636     }
1637
1638     if (d == 0 || !mozilla::IsFinite(d)) {
1639         *out = 0;
1640         return true;
1641     }
1642
1643     uint16_t u = (uint16_t) d;
1644     if ((double)u == d) {
1645         *out = u;
1646         return true;
1647     }
1648
1649     bool neg = (d < 0);
1650     d = floor(neg ? -d : d);
1651     d = neg ? -d : d;
1652     unsigned m = JS_BIT(16);
1653     d = fmod(d, (double) m);
1654     if (d < 0)
1655         d += m;
1656     *out = (uint16_t) d;
1657     return true;
1658 }
1659
1660 template<typename T>
1661 bool
1662 js::ToLengthClamped(T* cx, HandleValue v, uint32_t* out, bool* overflow)
1663 {
1664     if (v.isInt32()) {
1665         int32_t i = v.toInt32();
1666         *out = i < 0 ? 0 : i;
1667         return true;
1668     }
1669     double d;
1670     if (v.isDouble()) {
1671         d = v.toDouble();
1672     } else {
1673         if (!ToNumber(cx, v, &d)) {
1674             *overflow = false;
1675             return false;
1676         }
1677     }
1678     d = JS::ToInteger(d);
1679     if (d <= 0.0) {
1680         *out = 0;
1681         return true;
1682     }
1683     if (d >= (double)0xFFFFFFFEU) {
1684         *overflow = true;
1685         return false;
1686     }
1687     *out = (uint32_t)d;
1688     return true;
1689 }
1690
1691 template bool
1692 js::ToLengthClamped<JSContext>(JSContext*, HandleValue, uint32_t*, bool*);
1693 template bool
1694 js::ToLengthClamped<ExclusiveContext>(ExclusiveContext*, HandleValue, uint32_t*, bool*);
1695
1696 template <typename CharT>
1697 bool
1698 js_strtod(ExclusiveContext* cx, const CharT* begin, const CharT* end, const CharT** dEnd,
1699           double* d)
1700 {
1701     const CharT* s = SkipSpace(begin, end);
1702     size_t length = end - s;
1703
1704     Vector<char, 32> chars(cx);
1705     if (!chars.growByUninitialized(length + 1))
1706         return false;
1707
1708     size_t i = 0;
1709     for (; i < length; i++) {
1710         char16_t c = s[i];
1711         if (c >> 8)
1712             break;
1713         chars[i] = char(c);
1714     }
1715     chars[i] = 0;
1716
1717     /* Try to parse +Infinity, -Infinity or Infinity. */
1718     {
1719         char* afterSign = chars.begin();
1720         bool negative = (*afterSign == '-');
1721         if (negative || *afterSign == '+')
1722             afterSign++;
1723
1724         if (*afterSign == 'I' && !strncmp(afterSign, "Infinity", 8)) {
1725             *d = negative ? NegativeInfinity<double>() : PositiveInfinity<double>();
1726             *dEnd = s + (afterSign - chars.begin()) + 8;
1727             return true;
1728         }
1729     }
1730
1731     /* Everything else. */
1732     int err;
1733     char* ep;
1734     *d = js_strtod_harder(cx->dtoaState(), chars.begin(), &ep, &err);
1735
1736     MOZ_ASSERT(ep >= chars.begin());
1737
1738     if (ep == chars.begin())
1739         *dEnd = begin;
1740     else
1741         *dEnd = s + (ep - chars.begin());
1742
1743     return true;
1744 }
1745
1746 template bool
1747 js_strtod(ExclusiveContext* cx, const char16_t* begin, const char16_t* end, const char16_t** dEnd,
1748           double* d);
1749
1750 template bool
1751 js_strtod(ExclusiveContext* cx, const Latin1Char* begin, const Latin1Char* end,
1752           const Latin1Char** dEnd, double* d);