Merge pull request #9290 from electron/coerce-history-go-offset-to-number

Coerce window.history.go offset argument to number in renderer process

lib/renderer/window-setup.js

@@ -164,7 +164,7 @@ module.exports = (ipcRenderer, guestInstanceId, openerId, hiddenPage) => {
   }
 
   window.history.go = function (offset) {
-    sendHistoryOperation(ipcRenderer, 'goToOffset', offset)
+    sendHistoryOperation(ipcRenderer, 'goToOffset', +offset)
   }
 
   defineProperty(window.history, 'length', {

spec/chromium-spec.js

@@ -989,4 +989,12 @@ describe('chromium feature', function () {
       }, /Cannot convert object to primitive value/)
     })
   })
+
+  describe('window.history.go(offset)', function () {
+    it('throws an exception when the argumnet cannot be converted to a string', function () {
+      assert.throws(function () {
+        window.history.go({toString: null})
+      }, /Cannot convert object to primitive value/)
+    })
+  })
 })