Check for NaN inside RJSValidatedValueToNumber

Turns out this API can return NaN without an exception. Also added tests to make sure these conversions either work or throw exceptions in the appropriate places.

src/RJSUtil.hpp

@@ -112,6 +112,9 @@ static inline double RJSValidatedValueToNumber(JSContextRef ctx, JSValueRef valu
     if (exception) {
         throw RJSException(ctx, exception);
     }
+    if (isnan(number)) {
+        throw std::invalid_argument("Value not convertible to a number.");
+    }
     return number;
 }
 

tests/ArrayTests.js

@@ -261,6 +261,14 @@ var ArrayTests = {
             TestCase.assertEqual(removed[0].doubleCol, 1);
             TestCase.assertEqual(array.length, 0);
 
+            removed = array.splice('0', '0', obj.objectCol);
+            TestCase.assertEqual(removed.length, 0);
+            TestCase.assertEqual(array.length, 1);
+
+            TestCase.assertThrows(function() {
+                array.splice('cat', 1);
+            });
+
             TestCase.assertThrows(function() {
                 array.splice(0, 0, 0);
             });

tests/ObjectTests.js

@@ -64,6 +64,16 @@ var ObjectTests = {
         TestCase.assertEqual(obj.dateCol.getTime(), 2, 'wrong date value');
         TestCase.assertEqual(obj.dataCol, 'b', 'wrong data value');
 
+        realm.write(function() {
+            TestCase.assertThrows(function() {
+                obj.boolCol = 'cat';
+            });
+
+            TestCase.assertThrows(function() {
+                obj.intCol = 'dog';
+            });
+        });
+
         TestCase.assertThrows(function() {
             obj.boolCol = true;
         }, 'can only set property values in a write transaction');