Bug 1413319 - Correctly check a double is within long's limit r=birtles

When close to int64_t's limit, the int64 can't be precisely converted to
double because of rounding error, rounding-up is also allowed. To ensure
a double `d` is within int64's limit, we should check
`d < std::numeric_limits<int64_t>::max()`, instead of `<=`.

Because `std::numeric_limits<int64_t>::max()` might be converted to a larger
double, when they are equal, we can't be sure if `d` is indeed within the actual
int64 limit.

Differential Revision: https://phabricator.services.mozilla.com/D23680

--HG--
extra : moz-landing-system : lando

dom/smil/SMILTimedElement.cpp

@@ -1713,7 +1713,7 @@ SMILTimeValue SMILTimedElement::CalcActiveEnd(const SMILTimeValue& aBegin,
 SMILTimeValue SMILTimedElement::GetRepeatDuration() const {
   SMILTimeValue multipliedDuration;
   if (mRepeatCount.IsDefinite() && mSimpleDur.IsDefinite()) {
-    if (mRepeatCount * double(mSimpleDur.GetMillis()) <=
+    if (mRepeatCount * double(mSimpleDur.GetMillis()) <
         std::numeric_limits<SMILTime>::max()) {
       multipliedDuration.SetMillis(
           SMILTime(mRepeatCount * mSimpleDur.GetMillis()));

dom/smil/crashtests/1413319-1.html

@@ -0,0 +1,2 @@
+<svg width=''>
+<animate dur='2ms' repeatCount='4611686018427387903' fill='freeze'/>

dom/smil/crashtests/crashtests.list

@@ -59,3 +59,4 @@ load 1343357-1.html
 load 1375596-1.svg
 load 1402547-1.html
 load 1411963-1.html
+load 1413319-1.html