Bug 12382 – Crash on AMD64 in dtoa.cpp

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Jan Krämer]

When trying out WebKit/Qt ( on my AMD64 machine I got various crashes in
kjs_dtoa at dtoa.cpp:3015
*s++ = '0' + (int)L;

The problem seems to that the containing loop does not terminate correctly, as at the time of the crash the loop was in its 36021 iteration.

The kjs version in the KDE repository had a change applied:
http://websvn.kde.org/trunk/KDE/kdelibs/kjs/dtoa.cpp?rev=569434&r1=564344&r2=569434

Following the change in the WebKit "dtoa.cpp" version seems to fix the crash.

See also the comment in dtoa.cpp:
//#define Long int on machines with 32-bit ints and 64-bit longs.

[Jan Krämer]

Created attachment 12627 [details]
a small naive patch

[Lars Knoll]

Makes absolutely sense. We're using the same code in Qt and have applied the same fix there. 

I'd r+ it if I had the right to do so ;-)

[Jan Krämer]

Created attachment 12666 [details]
a simple naive patch

Added change log entry and request review :-)

I could not test for regressions, since it just did not run on my computer before this change.

If there is a supported platform that has int < 32bit, stdint.h would need to be included, and the patch changed to:
#define Long int32_t

[Jan Krämer]

Created attachment 12668 [details]
same patch...better changelog

Added the reason for the change to the changelog.
(I had it in there before a i did a revert on the changelog...and then forgot to add it again)

[Maciej Stachowiak]

Comment on attachment 12668 [details]
same patch...better changelog

r=me

[David Kilzer (:ddkilzer)]

Committed by lars in r19136.