From db0b5fc1ed107c71501839df856497bbab8b2433 Mon Sep 17 00:00:00 2001 From: "gavin%gavinsharp.com" Date: Thu, 9 Nov 2006 18:53:24 +0000 Subject: [PATCH] Bug 358569: When running with reduced FPU precision, the rounding error introduced by |d -=L*ds;| will cause |if (!(d *= 10.)) break;| to never be true, causing an infinite loop and consequent crash. Given |k| is already known, we know how often the loop should run, so use that as stop condition, also avoiding overwriting memory with 0. Patch by Keith Victor of MediaMachines, r=igor, r=crowder git-svn-id: svn://10.0.0.236/trunk@215041 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/js/src/jsdtoa.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/mozilla/js/src/jsdtoa.c b/mozilla/js/src/jsdtoa.c index 96684227829..529a5739d54 100644 --- a/mozilla/js/src/jsdtoa.c +++ b/mozilla/js/src/jsdtoa.c @@ -2396,7 +2396,9 @@ js_dtoa(double d, int mode, JSBool biasUp, int ndigits, goto no_digits; goto one_digit; } - for(i = 1;; i++) { + + /* Use true number of digits to limit looping. */ + for(i = 1; i<=k+1; i++) { L = (Long) (d / ds); d -= L*ds; #ifdef Check_FLT_ROUNDS @@ -2421,8 +2423,7 @@ js_dtoa(double d, int mode, JSBool biasUp, int ndigits, } break; } - if (!(d *= 10.)) - break; + d *= 10.; } goto ret1; }