From 38f6eb34b8fa638986691619e9d81b0a3f99ea8d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gabriel=20Iv=C4=83ncescu?= <gabrielopcode@gmail.com>
Date: Thu, 22 Jun 2023 16:19:01 +0300
Subject: [PATCH] jscript: Properly handle passing undefined value to
 Number.toString in ES5+ mode.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Gabriel Ivăncescu <gabrielopcode@gmail.com>
---
 dlls/jscript/number.c     | 2 +-
 dlls/jscript/tests/api.js | 1 +
 dlls/mshtml/tests/es5.js  | 3 +++
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/dlls/jscript/number.c b/dlls/jscript/number.c
index 00456daaf53..27c3d5ecfee 100644
--- a/dlls/jscript/number.c
+++ b/dlls/jscript/number.c
@@ -239,7 +239,7 @@ static HRESULT Number_toString(script_ctx_t *ctx, jsval_t vthis, WORD flags, uns
     if(FAILED(hres))
         return hres;
 
-    if(argc) {
+    if(argc && (ctx->version < SCRIPTLANGUAGEVERSION_ES5 || !is_undefined(argv[0]))) {
         hres = to_int32(ctx, argv[0], &radix);
         if(FAILED(hres))
             return hres;
diff --git a/dlls/jscript/tests/api.js b/dlls/jscript/tests/api.js
index fb98946fdc7..0fc683c20cb 100644
--- a/dlls/jscript/tests/api.js
+++ b/dlls/jscript/tests/api.js
@@ -2709,6 +2709,7 @@ testException(function() {Number.prototype.toFixed.call(arr);}, "E_NOT_NUM");
 testException(function() {Number.prototype.toLocaleString.call(arr);}, "E_NOT_NUM");
 testException(function() {Number.prototype.toLocaleString.call(null);}, "E_NOT_NUM");
 testException(function() {(new Number(3)).toString(1);}, "E_INVALID_CALL_ARG");
+testException(function() {(new Number(3)).toString(undefined);}, "E_INVALID_CALL_ARG");
 testException(function() {(new Number(3)).toFixed(21);}, "E_FRACTION_DIGITS_OUT_OF_RANGE");
 testException(function() {(new Number(1)).toPrecision(0);}, "E_PRECISION_OUT_OF_RANGE");
 if(invokeVersion < 2)
diff --git a/dlls/mshtml/tests/es5.js b/dlls/mshtml/tests/es5.js
index fb9b710c70c..e86ab1dbe77 100644
--- a/dlls/mshtml/tests/es5.js
+++ b/dlls/mshtml/tests/es5.js
@@ -1127,6 +1127,9 @@ sync_test("toString", function() {
     obj = Object.create(Number.prototype);
     tmp = Object.prototype.toString.call(obj);
     ok(tmp === "[object Object]", "toString.call(Object.create(Number.prototype)) = " + tmp);
+
+    tmp = (new Number(303)).toString(undefined);
+    ok(tmp === "303", "Number 303 toString(undefined) = " + tmp);
 });
 
 sync_test("bind", function() {