wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Use NSCoordSaturatingAdd to avoid integer overflow. b=541714 r=roc

Browse Source
This commit is contained in:
Mats Palmgren 2010-04-14 21:35:36 +02:00
parent 91827215e2
commit f282ed34fe
4 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
layout/generic/crashtests/541714-1.html Normal file
View File

@ -0,0 +1,3 @@
<html style="overflow: hidden;">
<body style="overflow: hidden; direction: rtl; padding: 0 64635% 0 66421238918787500pt; width: 39779329pt;"></body>
</html>

3
layout/generic/crashtests/541714-2.html Normal file
View File

@ -0,0 +1,3 @@
<html style="overflow: hidden;">
<body style="overflow: hidden; direction: rtl; padding: 64635% 0 66421238918787500pt 0; height: 39779329pt;"></body>
</html>

2
layout/generic/crashtests/crashtests.list
View File

@ -294,4 +294,6 @@ load 533379-2.html
load 534082-1.html
load 541277-1.html
load 541277-2.html
load 541714-1.html
load 541714-2.html
load 551635-1.html

12
layout/generic/nsBlockFrame.cpp
View File

@ -1249,8 +1249,10 @@ nsBlockFrame::ComputeFinalSize(const nsHTMLReflowState& aReflowState,
#endif
// Compute final width
aMetrics.width = borderPadding.left + aReflowState.ComputedWidth() +
borderPadding.right;
aMetrics.width =
NSCoordSaturatingAdd(NSCoordSaturatingAdd(borderPadding.left,
aReflowState.ComputedWidth()),
borderPadding.right);
// Return bottom margin information
// rbs says he hit this assertion occasionally (see bug 86947), so
@ -1321,7 +1323,11 @@ nsBlockFrame::ComputeFinalSize(const nsHTMLReflowState& aReflowState,
&& computedHeightLeftOver ),
"overflow container must not have computedHeightLeftOver");
aMetrics.height = borderPadding.top + computedHeightLeftOver + borderPadding.bottom;
aMetrics.height =
NSCoordSaturatingAdd(NSCoordSaturatingAdd(borderPadding.top,
computedHeightLeftOver),
borderPadding.bottom);
if (NS_FRAME_IS_NOT_COMPLETE(aState.mReflowStatus)
&& aMetrics.height < aReflowState.availableHeight) {
// We ran out of height on this page but we're incomplete