Bug 973321 - Prevent int overflow in border image width calculation. …

…r=dbaron
shellylin · Feb 18, 2014 · 982c234 · 982c234
1 parent 2836727
commit 982c234
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 1 deletion.
diff --git a/layout/base/nsCSSRendering.cpp b/layout/base/nsCSSRendering.cpp
@@ -3110,7 +3110,10 @@ DrawBorderImage(nsPresContext*       aPresContext,
         value = 0;
         break;
     }
-    border.Side(s) = NS_lround(value);
+    // NSToCoordRoundWithClamp rounds towards infinity, but that's OK
+    // because we expect value to be non-negative.
+    MOZ_ASSERT(value >= 0);
+    border.Side(s) = NSToCoordRoundWithClamp(value);
     MOZ_ASSERT(border.Side(s) >= 0);
   }
 

diff --git a/layout/style/crashtests/crashtests.list b/layout/style/crashtests/crashtests.list
@@ -101,3 +101,4 @@ load 927734-1.html
 load 930270-1.html
 load 930270-2.html
 load 945048-1.html
+load large_border_image_width.html
diff --git a/layout/style/crashtests/large_border_image_width.html b/layout/style/crashtests/large_border_image_width.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+<div style="border: 10px solid transparent; border-image-source: -moz-linear-gradient(0rad, blue 25px, green 25px); border-image-width: 5464618830153;"></div>
+</body>
+</html>
+