Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-27 04:38:02 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1490704 - check rect size in RectIsInt32Safe. r=mattwoodrow

Browse Source
This commit is contained in:
Lee Salzman 2018-11-12 17:09:12 -05:00
parent 63eccc1511
commit 0be53a4c8c
3 changed files with 31 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
gfx/2d/Rect.h
View File

@ -296,7 +296,9 @@ template<class units>
bool RectIsInt32Safe(const RectTyped<units>& aRect) {
float min = (float)std::numeric_limits<std::int32_t>::min();
float max = (float)std::numeric_limits<std::int32_t>::max();
return aRect.x > min && aRect.y > min && aRect.XMost() < max && aRect.YMost() < max;
return aRect.x > min && aRect.y > min &&
aRect.width < max && aRect.height < max &&
aRect.XMost() < max && aRect.YMost() < max;
}
template<class units>

27
gfx/tests/crashtests/1490704-1.html Normal file
View File

@ -0,0 +1,27 @@
<!DOCTYPE html>
<html>
<head>
<style class="">
* {
transform: scalex(10) !important;
block-size: calc(-25958*-8px + -23%);
}
@page :left {
@page :left {
*:link {}
}
}
* {
box-shadow: green calc(42em - 43357px) 45px, blue -3841px 125px, currentColor 21px 50268px, 168px 2px 50817px 253px orange;
-moz-columns: 2 auto ! important;
}
</style>
</head>
<body class="" style="inline-size:-moz-min-content!important">
<p class=""><canvas class="" width="1024">
</body>
</html>

1
gfx/tests/crashtests/crashtests.list
View File

@ -169,5 +169,6 @@ load 1467847-1.html
load 1468020.html
load 1470440.html
load 1478035.html
load 1490704-1.html
load 1501518.html
load 1503986-1.html