From b4fe058f4f44c0dab91941cc684325c73590f0a4 Mon Sep 17 00:00:00 2001
From: Vladimir Vukicevic <vladimir@pobox.com>
Date: Fri, 14 Jan 2011 10:46:22 -0800
Subject: [PATCH] b=625503; convert NaN correctly with typed array array
 conversion; r=waldo, a=dvander

---
 js/src/jstypedarray.cpp                       | 8 ++++++--
 js/src/tests/js1_8_5/extensions/typedarray.js | 4 ++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp
index b3989cc275f..163b78dcad2 100644
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -1116,8 +1116,12 @@ class TypedArrayTemplate
         if (v.isInt32())
             return NativeType(v.toInt32());
 
-        if (v.isDouble())
-            return NativeType(v.toDouble());
+        if (v.isDouble()) {
+            double d = v.toDouble();
+            if (!ArrayTypeIsFloatingPoint() && JS_UNLIKELY(JSDOUBLE_IS_NaN(d)))
+                return NativeType(int32(0));
+            return NativeType(d);
+        }
 
         if (v.isPrimitive() && !v.isMagic()) {
             jsdouble dval;
diff --git a/js/src/tests/js1_8_5/extensions/typedarray.js b/js/src/tests/js1_8_5/extensions/typedarray.js
index 56495cd9367..09f37a55d21 100644
--- a/js/src/tests/js1_8_5/extensions/typedarray.js
+++ b/js/src/tests/js1_8_5/extensions/typedarray.js
@@ -333,6 +333,10 @@ function test()
     checkThrows(function() new Float32Array(null));
     checkThrows(function() new Float32Array(undefined));
 
+    // check that NaN conversions happen correctly with array conversions
+    check(function() (new Int32Array([NaN])[0]) == 0);
+    check(function() { var q = new Float32Array([NaN])[0]; return q != q; });
+
     print ("done");
 
     reportCompare(0, TestFailCount, "typed array tests");