User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3a) Gecko/20021203 Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3a) Gecko/20021203 Large images that can be displayed in mozilla disapper when scaled. This only occurs when one of the axis is scaled and the other is left for mozilla to calculate. This is caused by an overflowing interger multiply in layout/html/base/src/nsImageFrame.cpp on lines 863 and 867. Reproducible: Always Steps to Reproduce: 1. load the attached page (up coming) 2. notice that the image loads fine. 3. click on one of buttons labled "2000(broken)" 4. notice that the image goes away. Actual Results: The image went away Expected Results: display the scaled image This bug was discovered at the project guttenberg website. Don't shift reload the attached page--this crashed mozilla(separate bug) I will attach the testcase and the patch soon.
Created attachment 108170 [details] [diff] [review] patch Ok what is going on here is mozilla is calculating height or width of an image. This is acomplished by a multiply and a divide. The current code does the multiply first, I assume, to avoid an underflow. However it does not defend against an overflow. What the patch does is to check for potential overflows, and if one will occur then it does the divide first.
Created attachment 108273 [details] [diff] [review] new better patch, passes JST Review Simulacrum Added a macro and cleaned up whitespace
Attachment #108170 - Attachment is obsolete: true
Created attachment 109187 [details] a test case that is simpler to use This testcase is simpler to user. Perhaps someone can verify the bug now. To see bug 1) Load this testcase. 2) Notice that the image displays. 3) Pick an atribute to change, for example the picture's width. 4) Click on the button labeled 690, notice that the image scales to be 690 pixels wide. 5) Click on the button labeled 6213, notice that the image scales to be 6213 pixels wide. 6) Click on the button labeled 6214(fails), notice that the image fails to display. Can be repeated for the height attribute, but reload first.
WFM on Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a5pre) Gecko/20070508 Minefield/3.0a5pre - may have been fixed by the reflow landing, I'm not sure.
Status: UNCONFIRMED → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → WORKSFORME
Original reporter here: WFM on Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070511 Minefield/3.0a5pre Also as noted by Stephanie, works on Linux with minefield, was broken in Gran Paradiso, but now fixed in Minefield, so being fixed by the reflow landing sounds like a good guess.
You need to log in before you can comment on or make changes to this bug.