Closed Bug 973321 Opened 6 years ago Closed 6 years ago

"Assertion failure: border.Side(s) >= 0"

Categories

(Core :: Layout, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla30

People

(Reporter: jruderman, Assigned: wchen)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(3 files)

Attached file testcase
Assertion failure: border.Side(s) >= 0, at layout/base/nsCSSRendering.cpp:3136

This assertion was added in bug 827227.
Attached file stack
Assignee: nobody → wchen
OS: Mac OS X → All
Hardware: x86_64 → All
This assertion is caused by NS_lround returning a negative value for very large double values.

value = coord.GetFactorValue() * borderWidths.Side(s);
...
border.Side(s) = NS_lround(value);
MOZ_ASSERT(border.Side(s) >= 0);
Attachment #8377841 - Flags: review?(dbaron)
Comment on attachment 8377841 [details] [diff] [review]
Prevent int overflow in border image width calculation.

>-    border.Side(s) = NS_lround(value);
>+    // NSToCoordRoundWithClamp rounds towards infinity, but that's OK
>+    // because we expect value to be non-negative.
>+    MOZ_ASSERT(value >= 0);
>+    border.Side(s) = NSToCoordRoundWithClamp(value);

I tend to think the comment isn't needed, because NSToCoordRound* are what we use for coordinate rounding in layout; using something else (such as lround) should require an explanation.

r=dbaron, although I'm a little skeptical about the use of fatal assertions here
Attachment #8377841 - Flags: review?(dbaron) → review+
https://hg.mozilla.org/mozilla-central/rev/dccc80373461
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
You need to log in before you can comment on or make changes to this bug.