[Webkit-unassigned] [Bug 69412] REGRESSIoN (r95399): Web process hangs when opening documents on Google Docs

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=69412





--- Comment #8 from Filip Pizlo <fpizlo at apple.com>  2011-10-10 13:21:49 PST ---
OK, looks like I see what's going on.  The double case of ArithMin and ArithMax are totally broken.  When the two values are equal, it adds them together.  So Math.min(1.5, 1.5) == 3.

The reason for the adding is to have efficient support for Math.min(1.5, NaN) and Math.min(NaN, 1.5).  When the two values are unordered (either or both are NaN), Math.min() should return NaN.  Easiest way to do that is if you know one is NaN (but you don't know *which* one) then you add the two numbers together, which is gauranteed to result in NaN.

But the unordered case was erroneously being reached when the two values were equal.

Patch forthcoming.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.