Closed Bug 1746989 Opened 4 years ago Closed 4 years ago

nsCoord.h:130:18: runtime error: -3.41666e+09 is outside the range of representable values of type 'int'

Categories

(Core :: DOM: Selection, defect)

Product:
Core
Component:
DOM: Selection
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
99 Branch
Tracking Flags:
Tracking Status
firefox97 --- wontfix
firefox98 --- wontfix
firefox99 --- fixed

People

(Reporter: tsmith, Assigned: hiro)

References

(Blocks 3 open bugs)

Details

(Keywords: csectype-undefined, testcase)

Attachments

(2 files)

testcase.html
159 bytes, text/html
Details
Bug 1746989 - Use NSToCoordRoundWithClamp in nsLayoutUtils::TransformRect to avoid undefined behavior in conversions from float to int. r?TYLin
48 bytes, text/x-phabricator-request
Details | Review
Attached file testcase.html —

Found while fuzzing m-c 20211217-ba22a155be2e (--enable-undefined-sanitizer --enable-fuzzing)

This was found by enabling the float-cast-overflow check in UBSan. This type of issue can create inconsistencies across platforms, architectures and optimization levels.

To enable this check add the following to your mozconfig:

ac_add_options --enable-undefined-sanitizer="float-cast-overflow"

To reproduce with the attached test case use the following commands:

$ pip install grizzly-framework
$ python -m grizzly.replay <ubsan-build>/firefox testcase.html --xvfb

src/objdir-ff-ubsan/dist/include/nsCoord.h:130:18: runtime error: -3.41666e+09 is outside the range of representable values of type 'int'
    #0 0x7fcece987c31 in nsLayoutUtils::TransformRect(nsIFrame const*, nsIFrame const*, nsRect&) src/layout/base/nsLayoutUtils.cpp
    #1 0x7fcece98813e in nsLayoutUtils::ClampRectToScrollFrames(nsIFrame*, nsRect const&) src/layout/base/nsLayoutUtils.cpp:2385:5
    #2 0x7fcece84e327 in mozilla::AccessibleCaret::SetPosition(nsIFrame*, int) src/layout/base/AccessibleCaret.cpp:248:7
    #3 0x7fcece855f24 in mozilla::AccessibleCaretManager::UpdateCaretsForSelectionMode(mozilla::EnumSet<mozilla::AccessibleCaretManager::UpdateCaretsHint, unsigned char> const&)::$_1::operator()(mozilla::AccessibleCaret*, nsIFrame*, int) const src/layout/base/AccessibleCaretManager.cpp:330:44
    #4 0x7fcece855f24 in mozilla::AccessibleCaretManager::UpdateCaretsForSelectionMode(mozilla::EnumSet<mozilla::AccessibleCaretManager::UpdateCaretsHint, unsigned char> const&) src/layout/base/AccessibleCaretManager.cpp:349:7
    #5 0x7fcece8550aa in mozilla::AccessibleCaretManager::UpdateCarets(mozilla::EnumSet<mozilla::AccessibleCaretManager::UpdateCaretsHint, unsigned char> const&) src/layout/base/AccessibleCaretManager.cpp:210:7
    #6 0x7fcece854d98 in mozilla::AccessibleCaretManager::OnSelectionChanged(mozilla::dom::Document*, mozilla::dom::Selection*, short) src/layout/base/AccessibleCaretManager.cpp:171:3
    #7 0x7fcece8e574d in mozilla::AccessibleCaretEventHub::NoActionState::OnSelectionChanged(mozilla::AccessibleCaretEventHub*, mozilla::dom::Document*, mozilla::dom::Selection*, short) src/layout/base/AccessibleCaretEventHub.cpp:87:25
    #8 0x7fcece853634 in mozilla::AccessibleCaretEventHub::OnSelectionChange(mozilla::dom::Document*, mozilla::dom::Selection*, short) src/layout/base/AccessibleCaretEventHub.cpp:664:11
    #9 0x7fcec978c953 in mozilla::dom::Selection::NotifySelectionListeners() src/dom/base/Selection.cpp:3169:10
    #10 0x7fceceb229b7 in nsFrameSelection::NotifySelectionListeners(mozilla::SelectionType) src/layout/generic/nsFrameSelection.cpp:2170:16
    #11 0x7fceceb24ff5 in nsFrameSelection::EndBatchChanges(short) src/layout/generic/nsFrameSelection.cpp:2161:5
    #12 0x7fcec979919c in mozilla::dom::Selection::EndBatchChanges(short) src/dom/base/Selection.cpp:3197:21
    #13 0x7fcec979b151 in mozilla::dom::SelectionBatcher::~SelectionBatcher() src/objdir-ff-ubsan/dist/include/mozilla/dom/Selection.h:958:19
    #14 0x7fcec9794240 in mozilla::dom::Selection::SetStartAndEndInternal(mozilla::dom::Selection::InLimiter, mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&, mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&, nsDirection, mozilla::ErrorResult&) src/dom/base/Selection.cpp:3490:1
    #15 0x7fcec9793cb0 in mozilla::dom::Selection::SelectAllChildren(nsINode&, mozilla::ErrorResult&) src/dom/base/Selection.cpp:2675:3
    #16 0x7fcece969f19 in nsDocumentViewer::SelectAll() src/layout/base/nsDocumentViewer.cpp:2454:14
    #17 0x7fcec9914097 in nsClipboardSelectAllNoneCommands::DoClipboardCommand(char const*, nsIContentViewerEdit*, nsICommandParams*) src/dom/base/nsGlobalWindowCommands.cpp
    #18 0x7fcec991373c in nsSelectionCommand::DoCommand(char const*, nsISupports*) src/dom/base/nsGlobalWindowCommands.cpp:654:10
    #19 0x7fcecbd2ea99 in nsControllerCommandTable::DoCommand(char const*, nsISupports*) src/dom/commandhandler/nsControllerCommandTable.cpp:138:26
    #20 0x7fcecbd2e82d in nsBaseCommandController::DoCommand(char const*) src/dom/commandhandler/nsBaseCommandController.cpp:114:24
    #21 0x7fcecbd3203c in nsCommandManager::DoCommand(char const*, nsICommandParams*, mozIDOMWindowProxy*) src/dom/commandhandler/nsCommandManager.cpp:193:22
    #22 0x7fcec955ddf5 in mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) src/dom/base/Document.cpp:5399:25
    #23 0x7fcecafd7430 in mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) src/objdir-ff-ubsan/dom/bindings/DocumentBinding.cpp:3772:36
    #24 0x7fcecb4f938e in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3306:13
    #25 0x7fced33acd51 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:388:13
    #26 0x7fced33acd51 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:475:12
    #27 0x7fced33ae467 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:535:10
    #28 0x7fced339719b in js::CallFromStack(JSContext*, JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:539:10
    #29 0x7fced339719b in Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3243:16
    #30 0x7fced337a0c3 in js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:357:13
    #31 0x7fced33ace56 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:507:13
    #32 0x7fced33ae467 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:535:10
    #33 0x7fced33ae66d in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) src/js/src/vm/Interpreter.cpp:552:8
    #34 0x7fced365f705 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/vm/CallAndConstruct.cpp:117:10
    #35 0x7fcecb0bd0a8 in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) src/objdir-ff-ubsan/dom/bindings/EventHandlerBinding.cpp:283:37
    #36 0x7fcecbe8ac7d in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) src/objdir-ff-ubsan/dist/include/mozilla/dom/EventHandlerBinding.h:365:12
    #37 0x7fcecbe73f2f in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) src/dom/events/JSEventHandler.cpp:201:12
    #38 0x7fcecbe423b5 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1309:22
    #39 0x7fcecbe435ed in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1500:17
    #40 0x7fcecbe8d4b3 in mozilla::EventListenerManager::HandleEvent(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.h:395:5
    #41 0x7fcecbe806a7 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:348:17
    #42 0x7fcecbe3257c in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:550:16
    #43 0x7fcecbe35b7a in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1085:11
    #44 0x7fcece961ab7 in nsDocumentViewer::LoadComplete(nsresult) src/layout/base/nsDocumentViewer.cpp:1085:7
    #45 0x7fced238666e in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) src/docshell/base/nsDocShell.cpp:6309:20
    #46 0x7fced2385993 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp:5698:7
    #47 0x7fced238792f in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp
    #48 0x7fcec8230b6e in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) src/uriloader/base/nsDocLoader.cpp:1376:3
    #49 0x7fcec822fa6b in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:974:14
    #50 0x7fcec822c7fa in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) src/uriloader/base/nsDocLoader.cpp:793:9
    #51 0x7fcec822e75e in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:676:5
    #52 0x7fced23c0b5d in nsDocShell::OnStopRequest(nsIRequest*, nsresult) src/docshell/base/nsDocShell.cpp:13571:23
    #53 0x7fcec5e1edd7 in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) src/netwerk/base/nsLoadGroup.cpp:614:22
    #54 0x7fcec5e21a54 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) src/netwerk/base/nsLoadGroup.cpp:518:10
    #55 0x7fcec9018915 in imgRequestProxy::RemoveFromLoadGroup() src/image/imgRequestProxy.cpp:372:15
    #56 0x7fcec9020f71 in imgRequestProxy::OnLoadComplete(bool) src/image/imgRequestProxy.cpp:1005:7
    #57 0x7fcec8fdbb5e in void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::'lambda5'(mozilla::image::IProgressObserver*)::operator()(mozilla::image::IProgressObserver*) const src/image/ProgressTracker.cpp:351:13
    #58 0x7fcec8fdbb5e in void mozilla::image::ImageObserverNotifier<mozilla::image::ObserverTable const*>::operator()<void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::'lambda5'(mozilla::image::IProgressObserver*)>(mozilla::image::ObserverTable const*) src/image/ProgressTracker.cpp:281:9
    #59 0x7fcec8fd9af9 in void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) src/image/ProgressTracker.cpp:350:5
    #60 0x7fcec8f7c842 in mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::$_1::operator()(mozilla::image::ObserverTable const*) const src/image/ProgressTracker.cpp:369:5
    #61 0x7fcec8f7c842 in decltype(fp(static_cast<mozilla::image::ObserverTable const*>(nullptr))) mozilla::image::CopyOnWrite<mozilla::image::ObserverTable>::Read<mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::$_1>(mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::$_1) const src/image/CopyOnWrite.h:155:12
    #62 0x7fcec8f7c842 in mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) src/image/ProgressTracker.cpp:368:14
    #63 0x7fcec8fb9146 in mozilla::image::VectorImage::OnSVGDocumentLoaded() src/image/VectorImage.cpp:1496:23
    #64 0x7fcec8fbe090 in mozilla::image::SVGLoadEventListener::HandleEvent(mozilla::dom::Event*) src/image/VectorImage.cpp:214:13
    #65 0x7fcecbe423b5 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1309:22
    #66 0x7fcecbe435ed in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1500:17
    #67 0x7fcecbe8d4b3 in mozilla::EventListenerManager::HandleEvent(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.h:395:5
    #68 0x7fcecbe806a7 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:348:17
    #69 0x7fcecbe3257c in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:550:16
    #70 0x7fcecbe35b7a in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1085:11
    #71 0x7fcecbe3a9b7 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) src/dom/events/EventDispatcher.cpp
    #72 0x7fcec9955b3c in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) src/dom/base/nsINode.cpp:1355:17
    #73 0x7fcecbe4f8e5 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&) src/dom/events/EventTarget.cpp:180:13
    #74 0x7fcecbdc4060 in mozilla::AsyncEventDispatcher::Run() src/dom/events/AsyncEventDispatcher.cpp:69:12
    #75 0x7fcec5abe596 in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:468:16
    #76 0x7fcec5a7f669 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:771:26
    #77 0x7fcec5a7cabe in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:607:15
    #78 0x7fcec5a7d2e4 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:391:36
    #79 0x7fcec5ab05c9 in mozilla::TaskController::InitializeInternal()::$_0::operator()() const src/xpcom/threads/TaskController.cpp:124:37
    #80 0x7fcec5ab05c9 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() src/xpcom/threads/nsThreadUtils.h:531:5
    #81 0x7fcec5a9bd38 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1183:16
    #82 0x7fcec5aa51d6 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:467:10
    #83 0x7fcec7044ad2 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:85:21
    #84 0x7fcec7046252 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:268:30
    #85 0x7fcec6ea4235 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:331:10
    #86 0x7fcec6ea4235 in MessageLoop::RunHandler() src/ipc/chromium/src/base/message_loop.cc:324:3
    #87 0x7fcec6ea4235 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:306:3
    #88 0x7fcece2af59d in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
    #89 0x7fced3093cbb in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:864:20
    #90 0x7fcec7046231 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:235:9
    #91 0x7fcec6ea4235 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:331:10
    #92 0x7fcec6ea4235 in MessageLoop::RunHandler() src/ipc/chromium/src/base/message_loop.cc:324:3
    #93 0x7fcec6ea4235 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:306:3
    #94 0x7fced3092e63 in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:701:34
    #95 0x7fced30a7050 in mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/Bootstrap.cpp:67:12
    #96 0x55f38578507a in content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #97 0x55f385785451 in main src/browser/app/nsBrowserApp.cpp:327:18
    #98 0x7fceeeec0bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
    #99 0x55f3856d4138 in _start (src/objdir-ff-ubsan/dist/bin/firefox+0xe5138)

A Pernosco session is available here: https://pernos.co/debug/tVpoaJ5RGXVwgopszvq-Cw/index.html

Component: Layout → DOM: Selection
Severity: -- → S3
Blocks: float-cast-overflow
Summary: src/objdir-ff-ubsan/dist/include/nsCoord.h:130:18: runtime error: -3.41666e+09 is outside the range of representable values of type 'int' → nsCoord.h:130:18: runtime error: -3.41666e+09 is outside the range of representable values of type 'int'

This issue is currently triggered by fuzzing when the 'float-cast-overflow' UBSan check is enabled. This issue will need to be addressed before the check can be enabled by default.

If it requires too much effort to fix immediately please ni? me and let me know. If necessary it will be added to a suppression list. Thank you :)

Flags: needinfo?(hikezoe.birchill)
Assignee: nobody → hikezoe.birchill
Status: NEW → ASSIGNED
Flags: needinfo?(hikezoe.birchill)
Pushed by hikezoe.birchill@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/b92badaa8e49 Use NSToCoordRoundWithClamp in nsLayoutUtils::TransformRect to avoid undefined behavior in conversions from float to int. r=TYLin

https://hg.mozilla.org/mozilla-central/rev/b92badaa8e49

Status: ASSIGNED → RESOLVED
Closed: 4 years ago
status-firefox99: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 99 Branch

Since the status are different for nightly and release, what's the status for beta?
For more information, please visit auto_nag documentation.

status-firefox98: --- → ?
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: