hang converting number to string

RESOLVED FIXED

Status

--
critical
RESOLVED FIXED
9 years ago
7 years ago

People

(Reporter: tim, Unassigned)

Tracking

Details

(Reporter)

Description

9 years ago
User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Build Identifier: 1.7R2

DToA.JS_dtoa() has a line:
  x = (i > 32) ? word0(d) << (64 - i) | word1(d) >>> (i - 32) : word1(d) << (32 - i);
this should be:
  x = (i > 32) ? ((long) word0(d)) << (64 - i) | word1(d) >>> (i - 32) : ((long) word1(d)) << (32 - i);

In the case of Double.longBitsToDouble(2), this  eventually leads to:
  S = pow5mult(S, s5);
trying to compute 5^2147483647, which almost literally takes forever.

It would probably be good to audit the other uses of word0 and word1.

Reproducible: Always

Steps to Reproduce:
double value = Double.longBitsToDouble(2);
ScriptRuntime.toString(value));
System.out.println("all done");
Actual Results:  
Hangs

Expected Results:  
Prints "all done"

Comment 1

7 years ago
I committed the change you proposed. Thanks!

https://github.com/mozilla/rhino/commit/a6c0bec9132f4b9ac286a2b062b0bd78503c27c2
Status: UNCONFIRMED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.