From ae7d8aa794645db7abaabc46efb484ab5c298861 Mon Sep 17 00:00:00 2001
From: Jonathan Watt <jwatt@jwatt.org>
Date: Thu, 14 Feb 2013 17:25:26 +0000
Subject: [PATCH] Bug 840720 - Check for the finiteness of the values returned
 from the ToDouble calls in the nsHTMLInputElement code. r=mounir.

---
 content/html/content/src/nsHTMLInputElement.cpp | 8 ++++----
 content/html/content/src/nsHTMLInputElement.h   | 6 ++++--
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/content/html/content/src/nsHTMLInputElement.cpp b/content/html/content/src/nsHTMLInputElement.cpp
index f114176116a..51021a1407b 100644
--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
@@ -1086,7 +1086,7 @@ nsHTMLInputElement::ConvertStringToNumber(nsAString& aValue,
       {
         nsresult ec;
         aResultValue = PromiseFlatString(aValue).ToDouble(&ec);
-        if (NS_FAILED(ec)) {
+        if (NS_FAILED(ec) || !MOZ_DOUBLE_IS_FINITE(aResultValue)) {
           return false;
         }
 
@@ -3074,8 +3074,8 @@ nsHTMLInputElement::SanitizeValue(nsAString& aValue)
     case NS_FORM_INPUT_NUMBER:
       {
         nsresult ec;
-        PromiseFlatString(aValue).ToDouble(&ec);
-        if (NS_FAILED(ec)) {
+        double val = PromiseFlatString(aValue).ToDouble(&ec);
+        if (NS_FAILED(ec) || !MOZ_DOUBLE_IS_FINITE(val)) {
           aValue.Truncate();
         }
       }
@@ -4518,7 +4518,7 @@ nsHTMLInputElement::GetStep() const
 
   nsresult ec;
   double step = stepStr.ToDouble(&ec);
-  if (NS_FAILED(ec) || step <= 0) {
+  if (NS_FAILED(ec) || !MOZ_DOUBLE_IS_FINITE(step) || step <= 0) {
     step = GetDefaultStep();
   }
 
diff --git a/content/html/content/src/nsHTMLInputElement.h b/content/html/content/src/nsHTMLInputElement.h
index 426f246705b..c167c98a7de 100644
--- a/content/html/content/src/nsHTMLInputElement.h
+++ b/content/html/content/src/nsHTMLInputElement.h
@@ -663,7 +663,8 @@ protected:
    * Returns the input's "minimum" (as defined by the HTML5 spec) as a double.
    * Note this takes account of any default minimum that the type may have.
    * Returns NaN if the min attribute isn't a valid floating point number and
-   * the input's type does not have a default minimum.
+   * the input's type does not have a default minimum. Otherwise, guaranteed
+   * to return a finite value.
    *
    * NOTE: Only call this if you know DoesMinMaxApply() returns true.
    */
@@ -673,7 +674,8 @@ protected:
    * Returns the input's "maximum" (as defined by the HTML5 spec) as a double.
    * Note this takes account of any default maximum that the type may have.
    * Returns NaN if the max attribute isn't a valid floating point number and
-   * the input's type does not have a default maximum.
+   * the input's type does not have a default maximum. Otherwise, guaranteed
+   * to return a finite value.
    *
    * NOTE:Only call this if you know DoesMinMaxApply() returns true.
    */