Bug 1451908 - Check for infinite value in txFormatNumberFunctionCall. r=peterv a=abillings
authorEric Rahm <erahm@mozilla.com>
Tue, 17 Apr 2018 11:22:04 -0700
changeset 461062 1a9006749da6f47a55d7f0eef667f9bdd2e5acd7
parent 461061 dd61ef4a8a42b600b02eace99baa04ad2a56cc55
child 461063 263870d5255f00a2ece2a54c5cc640b8e3f21acf
push id9145
push userarchaeopteryx@coole-files.de
push dateWed, 25 Apr 2018 10:13:22 +0000
treeherdermozilla-beta@1a9006749da6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerspeterv, abillings
bugs1451908
milestone60.0
Bug 1451908 - Check for infinite value in txFormatNumberFunctionCall. r=peterv a=abillings
dom/xslt/xslt/txFormatNumberFunctionCall.cpp
--- a/dom/xslt/xslt/txFormatNumberFunctionCall.cpp
+++ b/dom/xslt/xslt/txFormatNumberFunctionCall.cpp
@@ -260,16 +260,22 @@ txFormatNumberFunctionCall::evaluate(txI
 
     /*
      * FINALLY we're done with the parsing
      * now build the result string
      */
 
     value = fabs(value) * multiplier;
 
+    // Make sure the multiplier didn't push value to infinity.
+    if (value == mozilla::PositiveInfinity<double>()) {
+        return aContext->recycler()->getStringResult(format->mInfinity,
+                                                     aResult);
+    }
+
     // Prefix
     nsAutoString res(prefix);
 
     int bufsize;
     if (value > 1)
         bufsize = (int)log10(value) + 30;
     else
         bufsize = 1 + 30;