Bug 1413319 - Correctly check a double is within long's limit r=birtles
authorviolet <violet.bugreport@gmail.com>
Sun, 17 Mar 2019 23:34:02 +0000
changeset 522615 a9a91a32262e099d6366cb2c7500db10f551bf13
parent 522614 d011dfe8368374923cb69a0ab510d6814cbf3ab1
child 522616 cdd0849c3c1121ed0f943844ec56994cbdec4515
push id10871
push usercbrindusan@mozilla.com
push dateMon, 18 Mar 2019 15:49:32 +0000
treeherdermozilla-beta@018abdd16060 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbirtles
bugs1413319
milestone67.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1413319 - Correctly check a double is within long's limit r=birtles When close to int64_t's limit, the int64 can't be precisely converted to double because of rounding error, rounding-up is also allowed. To ensure a double `d` is within int64's limit, we should check `d < std::numeric_limits<int64_t>::max()`, instead of `<=`. Because `std::numeric_limits<int64_t>::max()` might be converted to a larger double, when they are equal, we can't be sure if `d` is indeed within the actual int64 limit. Differential Revision: https://phabricator.services.mozilla.com/D23680
dom/smil/SMILTimedElement.cpp
dom/smil/crashtests/1413319-1.html
dom/smil/crashtests/crashtests.list
--- a/dom/smil/SMILTimedElement.cpp
+++ b/dom/smil/SMILTimedElement.cpp
@@ -1708,17 +1708,17 @@ SMILTimeValue SMILTimedElement::CalcActi
   }
 
   return result;
 }
 
 SMILTimeValue SMILTimedElement::GetRepeatDuration() const {
   SMILTimeValue multipliedDuration;
   if (mRepeatCount.IsDefinite() && mSimpleDur.IsDefinite()) {
-    if (mRepeatCount * double(mSimpleDur.GetMillis()) <=
+    if (mRepeatCount * double(mSimpleDur.GetMillis()) <
         std::numeric_limits<SMILTime>::max()) {
       multipliedDuration.SetMillis(
           SMILTime(mRepeatCount * mSimpleDur.GetMillis()));
     }
   } else {
     multipliedDuration.SetIndefinite();
   }
 
new file mode 100644
--- /dev/null
+++ b/dom/smil/crashtests/1413319-1.html
@@ -0,0 +1,2 @@
+<svg width=''>
+<animate dur='2ms' repeatCount='4611686018427387903' fill='freeze'/>
--- a/dom/smil/crashtests/crashtests.list
+++ b/dom/smil/crashtests/crashtests.list
@@ -54,8 +54,9 @@ load 720103-1.svg
 load 849593-1.xhtml
 load 1010681-1.svg
 load 1322770-1.svg
 load 1322849-1.svg
 load 1343357-1.html
 load 1375596-1.svg
 load 1402547-1.html
 load 1411963-1.html
+load 1413319-1.html