Bug 358569: When running with reduced FPU precision, the rounding error introduced by |d -=L*ds;| will cause |if (!(d *= 10.)) break;| to never be true, causing an infinite loop and consequent crash. Given |k| is already known, we know how often the loop should run, so use that as stop condition, also avoiding overwriting memory with 0. Patch by Keith Victor of MediaMachines, r=igor, r=crowder

js/src/jsdtoa.c

@@ -2396,7 +2396,9 @@ js_dtoa(double d, int mode, JSBool biasUp, int ndigits,
                 goto no_digits;
             goto one_digit;
         }
-        for(i = 1;; i++) {
+
+        /* Use true number of digits to limit looping. */
+        for(i = 1; i<=k+1; i++) {
             L = (Long) (d / ds);
             d -= L*ds;
 #ifdef Check_FLT_ROUNDS
@@ -2421,8 +2423,7 @@ js_dtoa(double d, int mode, JSBool biasUp, int ndigits,
                 }
                 break;
             }
-            if (!(d *= 10.))
-                break;
+            d *= 10.;
         }
         goto ret1;
     }