jscript: Properly handle passing undefined value to Number.toString in ES5+ mode.

dlls/jscript/number.c

@@ -239,7 +239,7 @@ static HRESULT Number_toString(script_ctx_t *ctx, jsval_t vthis, WORD flags, uns
     if(FAILED(hres))
         return hres;
 
-    if(argc) {
+    if(argc && (ctx->version < SCRIPTLANGUAGEVERSION_ES5 || !is_undefined(argv[0]))) {
         hres = to_int32(ctx, argv[0], &radix);
         if(FAILED(hres))
             return hres;

dlls/jscript/tests/api.js

@@ -2709,6 +2709,7 @@ testException(function() {Number.prototype.toFixed.call(arr);}, "E_NOT_NUM");
 testException(function() {Number.prototype.toLocaleString.call(arr);}, "E_NOT_NUM");
 testException(function() {Number.prototype.toLocaleString.call(null);}, "E_NOT_NUM");
 testException(function() {(new Number(3)).toString(1);}, "E_INVALID_CALL_ARG");
+testException(function() {(new Number(3)).toString(undefined);}, "E_INVALID_CALL_ARG");
 testException(function() {(new Number(3)).toFixed(21);}, "E_FRACTION_DIGITS_OUT_OF_RANGE");
 testException(function() {(new Number(1)).toPrecision(0);}, "E_PRECISION_OUT_OF_RANGE");
 if(invokeVersion < 2)

dlls/mshtml/tests/es5.js

@@ -1127,6 +1127,9 @@ sync_test("toString", function() {
     obj = Object.create(Number.prototype);
     tmp = Object.prototype.toString.call(obj);
     ok(tmp === "[object Object]", "toString.call(Object.create(Number.prototype)) = " + tmp);
+
+    tmp = (new Number(303)).toString(undefined);
+    ok(tmp === "303", "Number 303 toString(undefined) = " + tmp);
 });
 
 sync_test("bind", function() {