40355 2010-06-09 00:16:10 -0700 Exception loading Google Wave in Safari 5 2010-06-11 09:42:56 -0700 1 1 1 Unclassified WebKit WebCore JavaScript 528+ (Nightly build) PC OS X 10.5 RESOLVED DUPLICATE 40367 GoogleBug, InRadar P1 Normal --- 1 noel.gordon webkit-unassigned abarth dan dunhamsteve eric jgw knorton oliver oldest_to_newest 235682 0 noel.gordon 2010-06-09 00:16:10 -0700 Load Google Wave in Safari 5 (win32, and/or mac/osx 10.5), the javascript console reports: RangeError: Maximum call stack size exceeded. and Google Wave stops working. Test results/reduction attached OSX Firefox 3.6 OK OSX Safari 4.0.4 OK OSX Chrome 5.0.375 OK OSX Safari 5.0 FAIL 235699 1 58221 noel.gordon 2010-06-09 01:09:54 -0700 Created attachment 58221 Test Case 235976 2 barraclough 2010-06-09 13:43:38 -0700 <rdar://problem/8076614> 236013 3 dunhamsteve 2010-06-09 14:34:37 -0700 This issue seems to only occur when Safari 5 is run in 32-bit mode. 236069 4 dunhamsteve 2010-06-09 16:04:55 -0700 If you replace: tmp = (tmp >> 1); with var tmp2 = (tmp >> 1); tmp = tmp2; the testcase passes. If you instrument the original testcase with print statements, tmp.toString() is "3" before the shift operation and "3.0000000000000004" afterwards. 236079 5 jgw 2010-06-09 16:36:25 -0700 The following is a related, but slightly narrower form of the bug: function merge(d,e,f) { var h,i,j,k; h = e - d; if (h < 3) { return } j = d + f; i = e + f; k = j + (i - j >> 1); merge(j,k,-f); merge(k,i,-f); } merge(0, 5, 0); From the console, when you set a breakpoint in merge(2, 5, 0): > i 5 > j 2 > (i - j) 3 > ((i - j) >> 1) 1 > j + ((i - j) >> 1) 5 <= WTF?! 236851 6 dunhamsteve 2010-06-11 08:56:41 -0700 Further reduced test case: function test() { var off = -0; var tmp = 5 + off; var tmp2 = (tmp >> 1); tmp = tmp >> 1; if (tmp != tmp2) document.getElementById("result").innerHTML = "fail "+tmp+" != "+tmp2; else document.getElementById("result").innerHTML = "pass"; } Gives: fail 5.000000000000002 != 2 It looks like adding "-0" to an integer results in a value that will right shift correctly in some contexts but not in others. (Note that tmp2 holds the correct value, but tmp does not.) 236873 7 oliver 2010-06-11 09:42:56 -0700 *** This bug has been marked as a duplicate of bug 40367 *** 58221 2010-06-09 01:09:54 -0700 2010-06-09 01:09:54 -0700 Test Case test-case.html text/html 579 noel.gordon PGh0bWw+IA0KPGhlYWQ+DQogPHNjcmlwdD4NCiAgZnVuY3Rpb24gdHJ1bmMoaSwgaiwgb2ZmKSB7 DQogICAgdmFyIGxvLCBoaSwgbGVuLCBtaWQ7IGxlbiA9IGogLSBpOw0KICAgIGlmIChsZW4gPCAz KSB7IHJldHVybjsgfQ0KICAgIGxvID0gaSArIG9mZjsNCiAgICBoaSA9IGogKyBvZmY7DQogICAg Ly8gbWlkID0gbG8gKyAoKGhpIC0gbG8pID4+IDEpOw0KICAgIHZhciB0bXAgPSBoaSAtIGxvOw0K ICAgIHRtcCA9ICh0bXAgPj4gMSk7DQogICAgbWlkID0gdG1wICsgbG87DQogICAgdHJ1bmMoaSwg bWlkLCAtb2ZmKTsNCiAgICB0cnVuYyhtaWQsIGosIC1vZmYpOw0KICB9DQoNCiAgZnVuY3Rpb24g dGVzdCgpIHsNCiAgICAvLyBwcmludCAncGFzcycgaWYgdHJ1bmMoKSByZXR1cm5zDQogICAgdHJ1 bmMoMCwgNSwgMCk7DQogICAgZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoInJlc3VsdCIpLmlubmVy SFRNTCA9ICJwYXNzIjsNCiAgfQ0KIDwvc2NyaXB0Pg0KPC9oZWFkPg0KPGJvZHkgb25sb2FkPSJ0 ZXN0KCkiPg0KIDxwcmUgaWQ9InJlc3VsdCI+cnVubmluZyAuLi48L3ByZT4NCjwvYm9keT4NCjwv aHRtbD4NCg0K