Closed Bug 664955 Opened 12 years ago Closed 12 years ago
"ASSERTION: parser should have rejected negative length"
###!!! ASSERTION: FindNextLargerFontSize failed: '*aSize > parentSize', file layout/style/nsRuleNode.cpp, line 2538 (bug 427322) ###!!! ASSERTION: parser should have rejected negative length: 'widthValue.IsCalcUnit()', file layout/style/nsRuleNode.cpp, line 6283
This is because nsStyleUtil::FindNextLargerFontSize returns a negative value (because of PRInt32 overflow). Maybe it can be fixed by checking that returned value is positive (and also, below or equal nscoord_MAX).
Comment on attachment 540231 [details] [diff] [review] patch v1 Should FindNextLargerFontSize be using the saturating computation functions?
That looks identical to v1 to me. What about my question from comment 2?
Sorry, wrong file attached. I should have checked more.
>+ largerSize = indexFontSize + NSCoordSaturatingNonnegativeMultiply(largerIndexFontSize - indexFontSize, relativePosition); Should that be a saturating add?
Comment on attachment 543360 [details] [diff] [review] patch v2.1 r=me. Thank you!
Attachment #543360 - Flags: review?(bzbarsky) → review+
Assignee: nobody → arno
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla7
You need to log in before you can comment on or make changes to this bug.