From 85bb2113febab715454f3c1044f4320fe7f4fe1f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Csaba=20Osztrogon=C3=A1c?= <oszi@inf.u-szeged.hu>
Date: Fri, 20 Dec 2019 08:57:17 +0100
Subject: [PATCH] Make Math.min() and Math.max() ECMA262 conform (#3465)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Math.min() and Math.max() functions should apply ToNumber on each arguments
always, even if a NaN argument occured previously and the result will be NaN.

ECMA262 v5.1 15.8.2:
"Each of the following Math object functions applies the ToNumber abstract
operator to each of its arguments (in left-to-right order if there is more
than one) and then performs a computation on the resulting Number value(s).

JerryScript-DCO-1.0-Signed-off-by: Csaba Osztrogonác oszi@inf.u-szeged.hu
---
 .../ecma/builtin-objects/ecma-builtin-math.c  | 16 ++++++---
 tests/jerry/math-functions-tonumber-rule.js   | 33 +++++++++++++++++++
 2 files changed, 44 insertions(+), 5 deletions(-)
 create mode 100644 tests/jerry/math-functions-tonumber-rule.js

diff --git a/jerry-core/ecma/builtin-objects/ecma-builtin-math.c b/jerry-core/ecma/builtin-objects/ecma-builtin-math.c
index 5475b347d..a85f04230 100644
--- a/jerry-core/ecma/builtin-objects/ecma-builtin-math.c
+++ b/jerry-core/ecma/builtin-objects/ecma-builtin-math.c
@@ -103,6 +103,7 @@ ecma_builtin_math_object_max_min (bool is_max, /**< 'max' or 'min' operation */
                                   ecma_length_t args_number) /**< number of arguments */
 {
   ecma_number_t result_num = ecma_number_make_infinity (is_max);
+  bool nan_found = false;
 
   while (args_number > 0)
   {
@@ -126,10 +127,13 @@ ecma_builtin_math_object_max_min (bool is_max, /**< 'max' or 'min' operation */
       ecma_fast_free_value (value);
     }
 
-    if (JERRY_UNLIKELY (ecma_number_is_nan (arg_num)))
+    arg++;
+    args_number--;
+
+    if (JERRY_UNLIKELY (nan_found || ecma_number_is_nan (arg_num)))
     {
-      result_num = arg_num;
-      break;
+      nan_found = true;
+      continue;
     }
 
     if (ecma_number_is_zero (arg_num)
@@ -149,9 +153,11 @@ ecma_builtin_math_object_max_min (bool is_max, /**< 'max' or 'min' operation */
         result_num = arg_num;
       }
     }
+  }
 
-    arg++;
-    args_number--;
+  if (JERRY_UNLIKELY (nan_found))
+  {
+    result_num = ecma_number_make_nan ();
   }
 
   return ecma_make_number_value (result_num);
diff --git a/tests/jerry/math-functions-tonumber-rule.js b/tests/jerry/math-functions-tonumber-rule.js
new file mode 100644
index 000000000..36f7524d1
--- /dev/null
+++ b/tests/jerry/math-functions-tonumber-rule.js
@@ -0,0 +1,33 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+var str = "";
+var a = {valueOf: function() { str += "a"; return 1;}};
+var b = {valueOf: function() { str += "b"; return NaN;}};
+var c = {valueOf: function() { str += "c"; return 2;}};
+
+Math.min (a, b, c);
+assert (str === "abc");
+
+str = "";
+Math.max (a, b, c);
+assert (str === "abc");
+
+str = "";
+Math.pow(b,a);
+assert (str === "ba");
+
+str = "";
+Math.atan2(b,a);
+assert (str === "ba");