Reviewed by Dan Bernstein.

        REGRESSION (r56560): Crash in parseFloat if passed invalid UTF-16 data
        https://bugs.webkit.org/show_bug.cgi?id=38083
        rdar://problem/7901044

        Tests: fast/js/ToNumber.html
               fast/js/parseFloat.html

        * runtime/JSGlobalObjectFunctions.cpp:
        (JSC::parseInt): Added a FIXME comment about a problem I noticed.
        (JSC::parseFloat): Added a FIXME comment about a problem I noticed;
        covered by test cases in the test I added.
        * runtime/UString.cpp:
        (JSC::UString::toDouble): Added FIXME comments about two problem I
        noticed; covered by test cases in the tests I added. Added a return
        statement so we don't crash when illegal UTF-16 sequences are present.
2010-04-24  Darin Adler  <darin@apple.com>

        Reviewed by Dan Bernstein.

        REGRESSION (r56560): Crash in parseFloat if passed invalid UTF-16 data
        https://bugs.webkit.org/show_bug.cgi?id=38083
        rdar://problem/7901044

        * fast/js/parseFloat-expected.txt: Added.
        * fast/js/parseFloat.html: Added.
        * fast/js/script-tests/parseFloat.js: Added.

        * fast/js/ToNumber-expected.txt: Added.
        * fast/js/ToNumber.html: Added.
        * fast/js/script-tests/ToNumber.js: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@58224 268f45cc-cd09-0410-ab3c-d52691b4dbfc