Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-25 05:41:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1290994 - Do not multiply 0 by infinity in nsCSSScanner::ScanNumber. r=heycam

Browse Source 
Without this patch test cases 1290995-{1,2,3}.html causes an assertion.
1290995-4.html is hit by the assertion in this patch if we don't avoid the
multiplication.

MozReview-Commit-ID: AtPVyPtd0r8

--HG--
extra : rebase_source : 43dbbbb98eb95faa15774b206a5776f43b1ea072
This commit is contained in:
Hiroyuki Ikezoe 2016-08-03 19:09:58 +09:00
parent b3a1d43416
commit 99d11e5e5f
6 changed files with 52 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
layout/style/crashtests/1290994-1.html Normal file
View File

@ -0,0 +1,11 @@
<!DOCTYPE html>
<html>
<script>
window.onload=function(){
var a = document.createElement("div");
document.documentElement.appendChild(a);
a.animate([{borderLeftColor:"black"},
{borderLeftColor:"hsl(0,0e309%,0%)"}]);
};
</script>
</html>

11
layout/style/crashtests/1290994-2.html Normal file
View File

@ -0,0 +1,11 @@
<!DOCTYPE html>
<html>
<script>
window.onload=function(){
var a = document.createElement("div");
document.documentElement.appendChild(a);
a.animate([{color:"rgb(0,0,0)"},
{color:"rgb(0e309%,0%,0%)"}]);
};
</script>
</html>

11
layout/style/crashtests/1290994-3.html Normal file
View File

@ -0,0 +1,11 @@
<!DOCTYPE html>
<html>
<script>
window.onload=function(){
var a = document.createElement("div");
document.documentElement.appendChild(a);
a.animate([{background: "-webkit-gradient(radial, 1 2, 8, 3 4, 9, from(lime))"},
{background: "-webkit-gradient(radial, 0e309 2, 8, 3 4, 9, from(lime))"}]);
};
</script>
</html>

8
layout/style/crashtests/1290994-4.html Normal file
View File

@ -0,0 +1,8 @@
<!DOCTYPE html>
<html>
<style>
@keyframes anim {
0e309% {}
}
</style>
</html>

4
layout/style/crashtests/crashtests.list
View File

@ -153,3 +153,7 @@ pref(layout.css.background-clip-text.enabled,true) load 1275026.html
load 1278463-1.html
pref(dom.animations-api.core.enabled,true) load 1277908-1.html
load 1277908-2.html
pref(dom.animations-api.core.enabled,true) load 1290994-1.html
pref(dom.animations-api.core.enabled,true) load 1290994-2.html
pref(dom.animations-api.core.enabled,true) load 1290994-3.html
load 1290994-4.html

10
layout/style/nsCSSScanner.cpp
View File

@ -930,9 +930,12 @@ nsCSSScanner::ScanNumber(nsCSSToken& aToken)
// Do all the math in double precision so it's truncated only once.
double value = sign * (intPart + fracPart);
if (gotE) {
// Explicitly cast expSign*exponent to double to avoid issues with
// overloaded pow() on Windows.
value *= pow(10.0, double(expSign * exponent));
// Avoid multiplication of 0 by Infinity.
if (value != 0.0) {
// Explicitly cast expSign*exponent to double to avoid issues with
// overloaded pow() on Windows.
value *= pow(10.0, double(expSign * exponent));
}
} else if (!gotDot) {
// Clamp values outside of integer range.
if (sign > 0) {
@ -958,6 +961,7 @@ nsCSSScanner::ScanNumber(nsCSSToken& aToken)
aToken.mIntegerValid = false;
}
}
MOZ_ASSERT(!IsNaN(value), "The value should not be NaN");
aToken.mNumber = value;
aToken.mType = type;
return true;