From df03810723b8eb95c12de9faf032cd3f01f85b4a Mon Sep 17 00:00:00 2001
From: Brian Smith <brian@dbsoft.org>
Date: Fri, 28 Jul 2023 19:55:53 -0500
Subject: [PATCH] Issue #1240 - Follow-up: Fix incorrect values in Number()
 constructor. https://bugzilla.mozilla.org/show_bug.cgi?id=1466893 Our code
 base was using the return value to create the Number object. However with the
 BigInt changes, it is no longer stored in rval, use args[0].

---
 js/src/jsnum.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/js/src/jsnum.cpp b/js/src/jsnum.cpp
index 4e8a5288e5..fd23e6ccd5 100644
--- a/js/src/jsnum.cpp
+++ b/js/src/jsnum.cpp
@@ -545,7 +545,9 @@ Number(JSContext* cx, unsigned argc, Value* vp)
     RootedObject proto(cx);
     if (!GetPrototypeFromConstructor(cx, newTarget, &proto))
         return false;
-    JSObject* obj = NumberObject::create(cx, args.rval().toNumber(), proto);
+
+    double d = args.length() > 0 ? args[0].toNumber() : 0;
+    JSObject* obj = NumberObject::create(cx, d, proto);
     if (!obj)
         return false;
     args.rval().setObject(*obj);