827227 - "ASSERTION: rounding error in width reduction???" with SVG, border-image

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: rounding error in width reduction???: 'border.left + border.right <= borderImgArea.width && border.top + border.bottom <= borderImgArea.height', file layout/base/nsCSSRendering.cpp, line 3124

This assertion is part of the original code for border-image:

changeset:   dda1146d1ec3
user:        William Chen
date:        Thu Dec 22 18:34:45 2011 -0500
summary:     Bug 497995: Part 1 - Implement border-image revisions in latest css3-background spec. r=dbaron

Comment 1

[William Chen [:wchen]]

Attachment: Fixed int overflow when scaling border-image-width.

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 705948 [details] [diff] [review]
Fixed int overflow when scaling border-image-width.

>+  uint32_t combinedBorderWidth = border.left + border.right;

You should (for both width and height) cast these values to uint32_t before the addition rather than waiting until after.  And I think you should also add an assertion that the values are positive, which can probably be done in the code above, either right before or right after the assignment to border.Side(s).

r=dbaron with that

Comment 3

[William Chen [:wchen]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4eed73abf01c

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/4eed73abf01c