This bug in ToNumber is the only reason WebKit fails a couple of array push/pop tests at the given URL. For a minimal test-case - do an unsigned right-shift as below. Every case should result in 3, but we get an answer of 0 when there's a non-breaking space: '\u0009 3' >>> 0; /* tab */ '\u0020 3' >>> 0; /* space */ '\u00a0 3' >>> 0; /* nbsp - fail! */ (see Section 9.3.1 of the EcmaScript 3rd edition spec for full list of white-space characters)
Committed r63120: <http://trac.webkit.org/changeset/63120>