From c2e51ab5410543fa008349fb90c8dc8db9baf30f Mon Sep 17 00:00:00 2001
From: Scott Kyle <scott@appden.com>
Date: Mon, 12 Oct 2015 16:50:45 -0700
Subject: [PATCH] Check for NaN inside RJSValidatedValueToNumber

Turns out this API can return NaN without an exception. Also added tests to make sure these conversions either work or throw exceptions in the appropriate places.
---
 src/RJSUtil.hpp      |  3 +++
 tests/ArrayTests.js  | 10 +++++++++-
 tests/ObjectTests.js | 10 ++++++++++
 3 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/src/RJSUtil.hpp b/src/RJSUtil.hpp
index 0a8412ed..056b93bb 100644
--- a/src/RJSUtil.hpp
+++ b/src/RJSUtil.hpp
@@ -112,6 +112,9 @@ static inline double RJSValidatedValueToNumber(JSContextRef ctx, JSValueRef valu
     if (exception) {
         throw RJSException(ctx, exception);
     }
+    if (isnan(number)) {
+        throw std::invalid_argument("Value not convertible to a number.");
+    }
     return number;
 }
 
diff --git a/tests/ArrayTests.js b/tests/ArrayTests.js
index 85a93df5..29cd15af 100644
--- a/tests/ArrayTests.js
+++ b/tests/ArrayTests.js
@@ -260,7 +260,15 @@ var ArrayTests = {
             TestCase.assertEqual(removed.length, 1);
             TestCase.assertEqual(removed[0].doubleCol, 1);
             TestCase.assertEqual(array.length, 0);
-            
+
+            removed = array.splice('0', '0', obj.objectCol);
+            TestCase.assertEqual(removed.length, 0);
+            TestCase.assertEqual(array.length, 1);
+
+            TestCase.assertThrows(function() {
+                array.splice('cat', 1);
+            });
+
             TestCase.assertThrows(function() {
                 array.splice(0, 0, 0);
             });
diff --git a/tests/ObjectTests.js b/tests/ObjectTests.js
index 3c84ecb3..d2ebbf1b 100644
--- a/tests/ObjectTests.js
+++ b/tests/ObjectTests.js
@@ -64,6 +64,16 @@ var ObjectTests = {
         TestCase.assertEqual(obj.dateCol.getTime(), 2, 'wrong date value');
         TestCase.assertEqual(obj.dataCol, 'b', 'wrong data value');
 
+        realm.write(function() {
+            TestCase.assertThrows(function() {
+                obj.boolCol = 'cat';
+            });
+
+            TestCase.assertThrows(function() {
+                obj.intCol = 'dog';
+            });
+        });
+
         TestCase.assertThrows(function() {
             obj.boolCol = true;
         }, 'can only set property values in a write transaction');