Bug 1627285 - Check for NaN before std::min/max() in DOMQuad and DOMRect. r=emilio,jwalden

Tests were added as a part of bug 1626471. Expectations that the tests fail
have been removed.

Differential Revision: https://phabricator.services.mozilla.com/D69605

--HG--
extra : moz-landing-system : lando

dom/base/DOMQuad.cpp

@@ -6,11 +6,11 @@
 
 #include "mozilla/dom/DOMQuad.h"
 
-#include "mozilla/dom/DOMQuadBinding.h"
 #include "mozilla/dom/DOMPoint.h"
+#include "mozilla/dom/DOMQuadBinding.h"
 #include "mozilla/dom/DOMRect.h"
 #include "mozilla/dom/DOMRectBinding.h"
-#include <algorithm>
+#include "mozilla/FloatingPoint.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -91,8 +91,8 @@ void DOMQuad::GetHorizontalMinMax(double* aX1, double* aX2) const {
   x1 = x2 = Point(0)->X();
   for (uint32_t i = 1; i < 4; ++i) {
     double x = Point(i)->X();
-    x1 = std::min(x1, x);
-    x2 = std::max(x2, x);
+    x1 = NaNSafeMin(x1, x);
+    x2 = NaNSafeMax(x2, x);
   }
   *aX1 = x1;
   *aX2 = x2;
@@ -103,8 +103,8 @@ void DOMQuad::GetVerticalMinMax(double* aY1, double* aY2) const {
   y1 = y2 = Point(0)->Y();
   for (uint32_t i = 1; i < 4; ++i) {
     double y = Point(i)->Y();
-    y1 = std::min(y1, y);
-    y2 = std::max(y2, y);
+    y1 = NaNSafeMin(y1, y);
+    y2 = NaNSafeMax(y2, y);
   }
   *aY1 = y1;
   *aY2 = y2;

dom/base/DOMRect.h

@@ -15,7 +15,7 @@
 #include "mozilla/Attributes.h"
 #include "mozilla/dom/BindingDeclarations.h"
 #include "mozilla/ErrorResult.h"
-#include <algorithm>
+#include "mozilla/FloatingPoint.h"
 
 struct nsRect;
 class nsIGlobalObject;
@@ -59,19 +59,19 @@ class DOMRectReadOnly : public nsISupports, public nsWrapperCache {
 
   double Left() const {
     double x = X(), w = Width();
-    return std::min(x, x + w);
+    return NaNSafeMin(x, x + w);
   }
   double Top() const {
     double y = Y(), h = Height();
-    return std::min(y, y + h);
+    return NaNSafeMin(y, y + h);
   }
   double Right() const {
     double x = X(), w = Width();
-    return std::max(x, x + w);
+    return NaNSafeMax(x, x + w);
   }
   double Bottom() const {
     double y = Y(), h = Height();
-    return std::max(y, y + h);
+    return NaNSafeMax(y, y + h);
   }
 
   bool WriteStructuredClone(JSContext* aCx,

mfbt/FloatingPoint.h

@@ -16,6 +16,7 @@
 #include "mozilla/MemoryChecking.h"
 #include "mozilla/Types.h"
 
+#include <algorithm>
 #include <limits>
 #include <stdint.h>
 #include <type_traits>
@@ -517,6 +518,30 @@ static inline bool EqualOrBothNaN(T aValue1, T aValue2) {
   return aValue1 == aValue2;
 }
 
+/**
+ * Return NaN if either |aValue1| or |aValue2| is NaN, or the minimum of
+ * |aValue1| and |aValue2| otherwise.
+ */
+template <typename T>
+static inline T NaNSafeMin(T aValue1, T aValue2) {
+  if (IsNaN(aValue1) || IsNaN(aValue2)) {
+    return UnspecifiedNaN<T>();
+  }
+  return std::min(aValue1, aValue2);
+}
+
+/**
+ * Return NaN if either |aValue1| or |aValue2| is NaN, or the maximum of
+ * |aValue1| and |aValue2| otherwise.
+ */
+template <typename T>
+static inline T NaNSafeMax(T aValue1, T aValue2) {
+  if (IsNaN(aValue1) || IsNaN(aValue2)) {
+    return UnspecifiedNaN<T>();
+  }
+  return std::max(aValue1, aValue2);
+}
+
 namespace detail {
 
 template <typename T>

testing/web-platform/meta/css/geometry/DOMQuad-001.html.ini

@@ -1,4 +0,0 @@
-[DOMQuad-001.html]
-  [fromRect() method on DOMQuad with Infinity: bounds]
-    expected: FAIL
-

testing/web-platform/meta/css/geometry/DOMQuad-nan.html.ini

@@ -1,19 +0,0 @@
-[DOMQuad-nan.html]
-  [Setting DOMQuad's p2.y to NaN]
-    expected: FAIL
-
-  [Setting DOMQuad's p2.x to NaN]
-    expected: FAIL
-
-  [Setting DOMQuad's p4.x to NaN]
-    expected: FAIL
-
-  [Setting DOMQuad's p3.x to NaN]
-    expected: FAIL
-
-  [Setting DOMQuad's p3.y to NaN]
-    expected: FAIL
-
-  [Setting DOMQuad's p4.y to NaN]
-    expected: FAIL
-

testing/web-platform/meta/css/geometry/DOMRect-nan.html.ini

@@ -1,13 +0,0 @@
-[DOMRect-nan.html]
-  [DOMRect's width is NaN]
-    expected: FAIL
-
-  [DOMRect's height is NaN]
-    expected: FAIL
-
-  [DOMRectReadOnly's height is NaN]
-    expected: FAIL
-
-  [DOMRectReadOnly's width is NaN]
-    expected: FAIL
-