548857 - hang converting number to string

Status: RESOLVED FIXED

(Rhino Graveyard :: Core, defect)

Description

[tim]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Build Identifier: 1.7R2

DToA.JS_dtoa() has a line:
  x = (i > 32) ? word0(d) << (64 - i) | word1(d) >>> (i - 32) : word1(d) << (32 - i);
this should be:
  x = (i > 32) ? ((long) word0(d)) << (64 - i) | word1(d) >>> (i - 32) : ((long) word1(d)) << (32 - i);

In the case of Double.longBitsToDouble(2), this  eventually leads to:
  S = pow5mult(S, s5);
trying to compute 5^2147483647, which almost literally takes forever.

It would probably be good to audit the other uses of word0 and word1.

Reproducible: Always

Steps to Reproduce:
double value = Double.longBitsToDouble(2);
ScriptRuntime.toString(value));
System.out.println("all done");
Actual Results:  
Hangs

Expected Results:  
Prints "all done"

Comment 1

[Hannes Wallnoefer]

I committed the change you proposed. Thanks!

https://github.com/mozilla/rhino/commit/a6c0bec9132f4b9ac286a2b062b0bd78503c27c2