Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-25 22:01:30 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1206105 - Use CheckedInt for an+b selector matching. r=bzbarsky

Browse Source 
--HG--
extra : transplant_source : %95Z1JF%FES%FF%9F%F8%F9%9D%5Eu%E7s%CC%8C%99%3C
This commit is contained in:
L. David Baron 2015-09-22 11:25:38 -07:00
parent 796640812b
commit 403e6f2a92
3 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
layout/style/crashtests/1206105-1.html Normal file
View File

@ -0,0 +1,6 @@
<!DOCTYPE HTML>
<title>crashtest, bug 1206105</title>
<style>
*:nth-child(-n-2147483647) {}
</style>
<body>

1
layout/style/crashtests/crashtests.list
View File

@ -121,5 +121,6 @@ load 1163446-1.html
load 1164813-1.html
load 1167782-1.html
load 1200568-1.html
load 1206105-1.html
load large_border_image_width.html
load border-image-visited-link.html

7
layout/style/nsCSSRuleProcessor.cpp
View File

@ -1571,8 +1571,11 @@ nthChildGenericMatches(Element* aElement,
// Integer division in C does truncation (towards 0). So
// check that the result is nonnegative, and that there was no
// truncation.
const int32_t n = (index - b) / a;
return n >= 0 && (a * n == index - b);
const CheckedInt<int32_t> indexMinusB = CheckedInt<int32_t>(index) - b;
const CheckedInt<int32_t> n = indexMinusB / a;
return n.isValid() &&
n.value() >= 0 &&
a * n == indexMinusB;
}
static inline bool