Issue #1240 - Follow-up: Fix incorrect values in Number() constructor.

https://bugzilla.mozilla.org/show_bug.cgi?id=1466893
Our code base was using the return value to create the Number object.
However with the BigInt changes, it is no longer stored in rval, use args[0].

1 files changed, 3 insertions, 1 deletions

diff --git a/js/src/jsnum.cpp b/js/src/jsnum.cpp
index 4e8a5288e5..fd23e6ccd5 100644
--- a/js/src/jsnum.cpp
+++ b/js/src/jsnum.cpp
@@ -545,7 +545,9 @@ Number(JSContext* cx, unsigned argc, Value* vp)
     RootedObject proto(cx);
     if (!GetPrototypeFromConstructor(cx, newTarget, &proto))
         return false;
-    JSObject* obj = NumberObject::create(cx, args.rval().toNumber(), proto);
+
+    double d = args.length() > 0 ? args[0].toNumber() : 0;
+    JSObject* obj = NumberObject::create(cx, d, proto);
     if (!obj)
         return false;
     args.rval().setObject(*obj);