645142 - "ABORT: negative lengths and percents should be rejected by parser" with huge font size

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Jesse Ruderman]

Attachment: testcase (asserts fatally when loaded)

###!!! ABORT: negative lengths and percents should be rejected by parser: 'sizeValue->IsCalcUnit()', file layout/style/nsRuleNode.cpp, line 2548

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Mats Palmgren (inactive)]

Attachment: fix

Comment 3

[Mats Palmgren (inactive)]

Comment on attachment 522239 [details]
fix

Clearly wrong....

Comment 4

[Mats Palmgren (inactive)]

Attachment: fix v2

The value is already in app units so we only need to clamp it.

Comment 5

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Comment on attachment 522240 [details] [diff] [review]
fix v2

If you're going to cast anything to float(), you should cast the
result of aPresContext->DeviceContext()->AppUnitsPerPhysicalInch(),
that is, to make it:

+  return NSToCoordRoundWithClamp(inches *
+    float(aPresContext->DeviceContext()->AppUnitsPerPhysicalInch()));

I think you should also use NSToCoordFloorClamped instead of
NSToCoordRoundWithClamp

r=dbaron with that

Comment 6

[Mats Palmgren (inactive)]

http://hg.mozilla.org/mozilla-central/rev/abe7b2a19824
http://hg.mozilla.org/mozilla-central/rev/e64b8000eff8

Comment 7

[Bob Clary [:bc] (inactive)]

I see this in recent Aurora and Nightly on Linux, Windows, Mac at a NSFW url (next comment will be private).

###!!! ABORT: negative lengths and percents should be rejected by parser: 'sizeValue->IsCalcUnit()', file /work/mozilla/builds/nightly/mozilla/layout/style/nsRuleNode.cpp, line 2561

pseudo stack: mozalloc_abort | Abort | NS_DebugBreak_P | nsRuleNode::SetFontSize nsRuleNode::SetFont nsRuleNode::ComputeFontData nsRuleNode::WalkRuleTree nsRuleNode::GetStyleData

Should this be reopened or a new bug filed?

Comment 9

[Jesse Ruderman]

New bug, please. And NSFW URLs don't automatically need to be security-sensitive :)