Bug 827227 - Fixed int overflow when scaling border-image-width. r=dbaron
authorWilliam Chen <wchen@mozilla.com>
Thu, 14 Feb 2013 11:57:20 -0800
changeset 131832 4eed73abf01c76a6546d43f39e81f443d2e56913
parent 131831 19abb6fef9dd8508ffa0f923ea5e4c184732e912
child 131833 f2291cff5ad841cd58df833fcd74f11effec09bd
push id2323
push userbbajaj@mozilla.com
push dateMon, 01 Apr 2013 19:47:02 +0000
treeherdermozilla-beta@7712be144d91 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdbaron
bugs827227
milestone21.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 827227 - Fixed int overflow when scaling border-image-width. r=dbaron
layout/base/nsCSSRendering.cpp
layout/reftests/border-image/border-image-width-large-ref.html
layout/reftests/border-image/border-image-width-large.html
layout/reftests/border-image/reftest.list
--- a/layout/base/nsCSSRendering.cpp
+++ b/layout/base/nsCSSRendering.cpp
@@ -3108,26 +3108,31 @@ DrawBorderImage(nsPresContext*       aPr
         value = nsPresContext::CSSPixelsToAppUnits(slice.Side(s));
         break;
       default:
         NS_NOTREACHED("unexpected CSS unit for border image area division");
         value = 0;
         break;
     }
     border.Side(s) = NS_lround(value);
+    MOZ_ASSERT(border.Side(s) >= 0);
   }
 
   // "If two opposite border-image-width offsets are large enough that they
   // overlap, their used values are proportionately reduced until they no
   // longer overlap."
-  double scaleX = border.left + border.right > borderImgArea.width
-                  ? borderImgArea.width / double(border.left + border.right)
+  uint32_t combinedBorderWidth = uint32_t(border.left) +
+                                 uint32_t(border.right);
+  double scaleX = combinedBorderWidth > uint32_t(borderImgArea.width)
+                  ? borderImgArea.width / double(combinedBorderWidth)
                   : 1.0;
-  double scaleY = border.top + border.bottom > borderImgArea.height
-                  ? borderImgArea.height / double(border.top + border.bottom)
+  uint32_t combinedBorderHeight = uint32_t(border.top) +
+                                  uint32_t(border.bottom);
+  double scaleY = combinedBorderHeight > uint32_t(borderImgArea.height)
+                  ? borderImgArea.height / double(combinedBorderHeight)
                   : 1.0;
   double scale = std::min(scaleX, scaleY);
   if (scale < 1.0) {
     border.left *= scale;
     border.right *= scale;
     border.top *= scale;
     border.bottom *= scale;
     NS_ASSERTION(border.left + border.right <= borderImgArea.width &&
new file mode 100644
--- /dev/null
+++ b/layout/reftests/border-image/border-image-width-large-ref.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html lang="en-US">
+<head>
+  <title>border-image with equally large left and right border image width.</title>
+  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+  <meta http-equiv="Content-Style-Type" content="text/css">
+  <style type="text/css">
+
+  table { margin: 0; padding: 0; border-spacing: 0; empty-cells: show; }
+  td { padding: 0; }
+
+  </style>
+</head>
+<body>
+<table>
+  <col style="width: 57px">
+  <col style="width: 57px">
+  <tr style="height: 24px">
+    <td style="background: #90a213"></td>
+    <td style="background: #90c157"></td>
+  </tr>
+</table>
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/reftests/border-image/border-image-width-large.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html lang="en-US">
+<head>
+  <title>test of border-image with equally large left and right border image width.</title>
+  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+  <meta http-equiv="Content-Style-Type" content="text/css">
+  <style type="text/css">
+  div {
+    border-width: 7px;
+    border-style: solid;
+    border-image: url('3x3multicolor.png') 1 1 1 1 / 0 2000000000em 0 2000000000em;
+  }
+  </style>
+</head>
+<body>
+<div style="width: 100px; height: 10px;"></div>
+</body>
+</html>
--- a/layout/reftests/border-image/reftest.list
+++ b/layout/reftests/border-image/reftest.list
@@ -23,16 +23,17 @@
 == center-scaling-4l.html center-scaling-4l-ref.html
 == center-scaling-4tb.html center-scaling-4tb-ref.html
 == center-scaling-4lr.html center-scaling-4lr-ref.html
 == side-scaling-1h.html side-scaling-1h-ref.html
 == side-scaling-1v.html side-scaling-1v-ref.html
 == border-image-width-1a.html border-image-width-1-ref.html
 == border-image-width-1b.html border-image-width-1-ref.html
 == border-image-width-1c.html border-image-width-1-ref.html
+== border-image-width-large.html border-image-width-large-ref.html
 == border-image-outset-1a.html border-image-outset-1-ref.html
 == border-image-outset-1b.html border-image-outset-1-ref.html
 == border-image-outset-1c.html border-image-outset-1-ref.html
 == border-image-nofill-1.html border-image-nofill-1-ref.html
 == border-image-outset-resize-1.html border-image-outset-resize-1-ref.html
 == border-image-outset-move-1.html border-image-outset-move-1-ref.html
 == border-image-style-none.html border-image-style-none-ref.html
 == border-image-style-none-length.html border-image-style-none-length-ref.html