Bug 369418. Prevent script from injecting floating point infinity or NaN values into C++ land through DOM interfaces. r+sr=roc@ocallahan.org, a=blocking1.9
authorjwatt@jwatt.org
Tue, 08 Apr 2008 04:47:57 -0700
changeset 14038 99de43696027e694cd89f9d63e4d062324cc6bb7
parent 14037 67ddca037ca40df3bc7c432f1110a79a536d0ebe
child 14039 077f70ec9144c1651cf71a8b4ce85ff8b7bea69c
push idunknown
push userunknown
push dateunknown
reviewersblocking1
bugs369418
milestone1.9pre
Bug 369418. Prevent script from injecting floating point infinity or NaN values into C++ land through DOM interfaces. r+sr=roc@ocallahan.org, a=blocking1.9
content/Makefile.in
content/base/public/nsContentUtils.h
content/svg/content/src/nsSVGAngle.cpp
content/svg/content/src/nsSVGFilters.cpp
content/svg/content/src/nsSVGLength.cpp
content/svg/content/src/nsSVGMatrix.cpp
content/svg/content/src/nsSVGNumber.cpp
content/svg/content/src/nsSVGNumber2.h
content/svg/content/src/nsSVGPathElement.cpp
content/svg/content/src/nsSVGPathSeg.cpp
content/svg/content/src/nsSVGPoint.cpp
content/svg/content/src/nsSVGRect.cpp
content/svg/content/src/nsSVGSVGElement.cpp
content/svg/content/src/nsSVGTransform.cpp
--- a/content/Makefile.in
+++ b/content/Makefile.in
@@ -58,10 +58,19 @@ DIRS            += mathml
 endif
 
 DIRS           += events
 
 ifdef ENABLE_TESTS
 TOOL_DIRS += test
 endif
 
+# Prevent floating point errors caused by VC++ optimizations
+ifeq ($(OS_ARCH)_$(GNU_CC),WINNT_)
+ifeq (,$(filter-out 1200 1300 1310,$(_MSC_VER)))
+CFLAGS += -Op
+else
+CFLAGS += -fp:precise
+endif
+endif # WINNT
+
 include $(topsrcdir)/config/rules.mk
 
--- a/content/base/public/nsContentUtils.h
+++ b/content/base/public/nsContentUtils.h
@@ -38,16 +38,17 @@
  * ***** END LICENSE BLOCK ***** */
 
 /* A namespace class for static content utilities. */
 
 #ifndef nsContentUtils_h___
 #define nsContentUtils_h___
 
 #include "jspubtd.h"
+#include "jsnum.h"
 #include "nsAString.h"
 #include "nsIStatefulFrame.h"
 #include "nsIPref.h"
 #include "nsINodeInfo.h"
 #include "nsNodeInfoManager.h"
 #include "nsContentList.h"
 #include "nsDOMClassInfoID.h"
 #include "nsIClassInfo.h"
@@ -1390,9 +1391,62 @@ public:
   if (aIID.Equals(NS_GET_IID(_interface))) {                                  \
     foundInterface = static_cast<_interface *>(_allocator);                   \
     if (!foundInterface) {                                                    \
       *aInstancePtr = nsnull;                                                 \
       return NS_ERROR_OUT_OF_MEMORY;                                          \
     }                                                                         \
   } else
 
+/*
+ * Check whether a floating point number is finite (not +/-infinity and not a
+ * NaN value). We wrap JSDOUBLE_IS_FINITE in a function because it expects to
+ * take the address of its argument, and because the argument must be of type
+ * jsdouble to have the right size and layout of bits.
+ *
+ * Note: we could try to exploit the fact that |infinity - infinity == NaN|
+ * instead of using JSDOUBLE_IS_FINITE. This would produce more compact code
+ * and perform better by avoiding type conversions and bit twiddling.
+ * Unfortunately, some architectures don't guarantee that |f == f| evaluates
+ * to true (where f is any *finite* floating point number). See
+ * https://bugzilla.mozilla.org/show_bug.cgi?id=369418#c63 . To play it safe
+ * for gecko 1.9, we just reuse JSDOUBLE_IS_FINITE.
+ */
+inline NS_HIDDEN_(PRBool) NS_FloatIsFinite(jsdouble f) {
+  return JSDOUBLE_IS_FINITE(f);
+}
+
+/*
+ * In the following helper macros we exploit the fact that the result of a
+ * series of additions will not be finite if any one of the operands in the
+ * series is not finite.
+ */
+#define NS_ENSURE_FINITE(f, rv)                                               \
+  if (!NS_FloatIsFinite(f)) {                                                 \
+    return (rv);                                                              \
+  }
+
+#define NS_ENSURE_FINITE2(f1, f2, rv)                                         \
+  if (!NS_FloatIsFinite((f1)+(f2))) {                                         \
+    return (rv);                                                              \
+  }
+
+#define NS_ENSURE_FINITE3(f1, f2, f3, rv)                                     \
+  if (!NS_FloatIsFinite((f1)+(f2)+(f3))) {                                    \
+    return (rv);                                                              \
+  }
+
+#define NS_ENSURE_FINITE4(f1, f2, f3, f4, rv)                                 \
+  if (!NS_FloatIsFinite((f1)+(f2)+(f3)+(f4))) {                               \
+    return (rv);                                                              \
+  }
+
+#define NS_ENSURE_FINITE5(f1, f2, f3, f4, f5, rv)                             \
+  if (!NS_FloatIsFinite((f1)+(f2)+(f3)+(f4)+(f5))) {                          \
+    return (rv);                                                              \
+  }
+
+#define NS_ENSURE_FINITE6(f1, f2, f3, f4, f5, f6, rv)                         \
+  if (!NS_FloatIsFinite((f1)+(f2)+(f3)+(f4)+(f5)+(f6))) {                     \
+    return (rv);                                                              \
+  }
+
 #endif /* nsContentUtils_h___ */
--- a/content/svg/content/src/nsSVGAngle.cpp
+++ b/content/svg/content/src/nsSVGAngle.cpp
@@ -48,32 +48,43 @@ public:
     { mVal.Init(); }
     
   NS_IMETHOD GetUnitType(PRUint16* aResult)
     { *aResult = mVal.mSpecifiedUnitType; return NS_OK; }
 
   NS_IMETHOD GetValue(float* aResult)
     { *aResult = mVal.GetBaseValue(); return NS_OK; }
   NS_IMETHOD SetValue(float aValue)
-    { mVal.SetBaseValue(aValue, nsnull); return NS_OK; }
+    {
+      NS_ENSURE_FINITE(aValue, NS_ERROR_ILLEGAL_VALUE);
+      mVal.SetBaseValue(aValue, nsnull);
+      return NS_OK;
+    }
 
   NS_IMETHOD GetValueInSpecifiedUnits(float* aResult)
     { *aResult = mVal.mBaseVal; return NS_OK; }
   NS_IMETHOD SetValueInSpecifiedUnits(float aValue)
-    { mVal.mBaseVal = aValue; return NS_OK; }
+    {
+      NS_ENSURE_FINITE(aValue, NS_ERROR_ILLEGAL_VALUE);
+      mVal.mBaseVal = aValue;
+      return NS_OK;
+    }
 
   NS_IMETHOD SetValueAsString(const nsAString& aValue)
     { return mVal.SetBaseValueString(aValue, nsnull, PR_FALSE); }
   NS_IMETHOD GetValueAsString(nsAString& aValue)
     { mVal.GetBaseValueString(aValue); return NS_OK; }
 
   NS_IMETHOD NewValueSpecifiedUnits(PRUint16 unitType,
                                     float valueInSpecifiedUnits)
-    { mVal.NewValueSpecifiedUnits(unitType, valueInSpecifiedUnits, nsnull);
-      return NS_OK; }
+    {
+      NS_ENSURE_FINITE(valueInSpecifiedUnits, NS_ERROR_ILLEGAL_VALUE);
+      mVal.NewValueSpecifiedUnits(unitType, valueInSpecifiedUnits, nsnull);
+      return NS_OK;
+    }
 
   NS_IMETHOD ConvertToSpecifiedUnits(PRUint16 unitType)
     { mVal.ConvertToSpecifiedUnits(unitType, nsnull); return NS_OK; }
 
 private:
   nsSVGAngle mVal;
 };
 
--- a/content/svg/content/src/nsSVGFilters.cpp
+++ b/content/svg/content/src/nsSVGFilters.cpp
@@ -659,16 +659,17 @@ NS_IMETHODIMP nsSVGFEGaussianBlurElement
 NS_IMETHODIMP nsSVGFEGaussianBlurElement::GetStdDeviationY(nsIDOMSVGAnimatedNumber * *aY)
 {
   return mNumberAttributes[STD_DEV_Y].ToDOMAnimatedNumber(aY, this);
 }
 
 NS_IMETHODIMP
 nsSVGFEGaussianBlurElement::SetStdDeviation(float stdDeviationX, float stdDeviationY)
 {
+  NS_ENSURE_FINITE2(stdDeviationX, stdDeviationY, NS_ERROR_ILLEGAL_VALUE);
   mNumberAttributes[STD_DEV_X].SetBaseValue(stdDeviationX, this, PR_TRUE);
   mNumberAttributes[STD_DEV_Y].SetBaseValue(stdDeviationY, this, PR_TRUE);
   return NS_OK;
 }
 
 PRBool
 nsSVGFEGaussianBlurElement::ParseAttribute(PRInt32 aNameSpaceID, nsIAtom* aName,
                                            const nsAString& aValue,
@@ -1664,16 +1665,17 @@ NS_IMETHODIMP nsSVGFECompositeElement::G
 NS_IMETHODIMP nsSVGFECompositeElement::GetK4(nsIDOMSVGAnimatedNumber * *aK4)
 {
   return mNumberAttributes[K4].ToDOMAnimatedNumber(aK4, this);
 }
 
 NS_IMETHODIMP
 nsSVGFECompositeElement::SetK(float k1, float k2, float k3, float k4)
 {
+  NS_ENSURE_FINITE4(k1, k2, k3, k4, NS_ERROR_ILLEGAL_VALUE);
   mNumberAttributes[K1].SetBaseValue(k1, this, PR_TRUE);
   mNumberAttributes[K2].SetBaseValue(k2, this, PR_TRUE);
   mNumberAttributes[K3].SetBaseValue(k3, this, PR_TRUE);
   mNumberAttributes[K4].SetBaseValue(k4, this, PR_TRUE);
   return NS_OK;
 }
 
 nsresult
@@ -3768,16 +3770,17 @@ NS_IMETHODIMP nsSVGFEMorphologyElement::
 NS_IMETHODIMP nsSVGFEMorphologyElement::GetRadiusY(nsIDOMSVGAnimatedNumber * *aY)
 {
   return mNumberAttributes[RADIUS_Y].ToDOMAnimatedNumber(aY, this);
 }
 
 NS_IMETHODIMP
 nsSVGFEMorphologyElement::SetRadius(float rx, float ry)
 {
+  NS_ENSURE_FINITE2(rx, ry, NS_ERROR_ILLEGAL_VALUE);
   mNumberAttributes[RADIUS_X].SetBaseValue(rx, this, PR_TRUE);
   mNumberAttributes[RADIUS_Y].SetBaseValue(ry, this, PR_TRUE);
   return NS_OK;
 }
 
 PRBool
 nsSVGFEMorphologyElement::ParseAttribute(PRInt32 aNameSpaceID, nsIAtom* aName,
                                          const nsAString& aValue,
--- a/content/svg/content/src/nsSVGLength.cpp
+++ b/content/svg/content/src/nsSVGLength.cpp
@@ -268,16 +268,18 @@ nsSVGLength::GetValue(float *aValue)
       return NS_ERROR_UNEXPECTED;
   }
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsSVGLength::SetValue(float aValue)
 {
+  NS_ENSURE_FINITE(aValue, NS_ERROR_ILLEGAL_VALUE);
+
   nsresult rv = NS_OK;
 
   WillModify();
 
   switch (mSpecifiedUnitType) {
     case SVG_LENGTHTYPE_NUMBER:
     case SVG_LENGTHTYPE_PX:
       mValueInSpecifiedUnits = aValue;
@@ -324,16 +326,17 @@ NS_IMETHODIMP
 nsSVGLength::GetValueInSpecifiedUnits(float *aValueInSpecifiedUnits)
 {
   *aValueInSpecifiedUnits = mValueInSpecifiedUnits;
   return NS_OK;
 }
 NS_IMETHODIMP
 nsSVGLength::SetValueInSpecifiedUnits(float aValueInSpecifiedUnits)
 {
+  NS_ENSURE_FINITE(aValueInSpecifiedUnits, NS_ERROR_ILLEGAL_VALUE);
   WillModify();
   mValueInSpecifiedUnits = aValueInSpecifiedUnits;
   DidModify();
   return NS_OK;
 }
 
 /* attribute DOMString valueAsString; */
 NS_IMETHODIMP
@@ -451,16 +454,18 @@ nsSVGLength::SetValueAsString(const nsAS
     
   return rv;
 }
 
 /* void newValueSpecifiedUnits (in unsigned short unitType, in float valueInSpecifiedUnits); */
 NS_IMETHODIMP
 nsSVGLength::NewValueSpecifiedUnits(PRUint16 unitType, float valueInSpecifiedUnits)
 {
+  NS_ENSURE_FINITE(valueInSpecifiedUnits, NS_ERROR_ILLEGAL_VALUE);
+
   if (!IsValidUnitType(unitType))
     return NS_ERROR_FAILURE;
 
   PRBool observer_change = (unitType != mSpecifiedUnitType);
 
   WillModify();
   if (observer_change)
     MaybeRemoveAsObserver();
--- a/content/svg/content/src/nsSVGMatrix.cpp
+++ b/content/svg/content/src/nsSVGMatrix.cpp
@@ -110,86 +110,92 @@ NS_INTERFACE_MAP_END
 /* attribute float a; */
 NS_IMETHODIMP nsSVGMatrix::GetA(float *aA)
 {
   *aA = mA;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGMatrix::SetA(float aA)
 {
+  NS_ENSURE_FINITE(aA, NS_ERROR_ILLEGAL_VALUE);
   WillModify();
   mA = aA;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float b; */
 NS_IMETHODIMP nsSVGMatrix::GetB(float *aB)
 {
   *aB = mB;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGMatrix::SetB(float aB)
 {
+  NS_ENSURE_FINITE(aB, NS_ERROR_ILLEGAL_VALUE);
   WillModify();
   mB = aB;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float c; */
 NS_IMETHODIMP nsSVGMatrix::GetC(float *aC)
 {
   *aC = mC;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGMatrix::SetC(float aC)
 {
+  NS_ENSURE_FINITE(aC, NS_ERROR_ILLEGAL_VALUE);
   WillModify();
   mC = aC;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float d; */
 NS_IMETHODIMP nsSVGMatrix::GetD(float *aD)
 {
   *aD = mD;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGMatrix::SetD(float aD)
 {
+  NS_ENSURE_FINITE(aD, NS_ERROR_ILLEGAL_VALUE);
   WillModify();
   mD = aD;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float e; */
 NS_IMETHODIMP nsSVGMatrix::GetE(float *aE)
 {
   *aE = mE;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGMatrix::SetE(float aE)
 {
+  NS_ENSURE_FINITE(aE, NS_ERROR_ILLEGAL_VALUE);
   WillModify();
   mE = aE;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float f; */
 NS_IMETHODIMP nsSVGMatrix::GetF(float *aF)
 {
   *aF = mF;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGMatrix::SetF(float aF)
 {
+  NS_ENSURE_FINITE(aF, NS_ERROR_ILLEGAL_VALUE);
   WillModify();
   mF = aF;
   DidModify();
   return NS_OK;
 }
 
 /* nsIDOMSVGMatrix multiply (in nsIDOMSVGMatrix secondMatrix); */
 NS_IMETHODIMP nsSVGMatrix::Multiply(nsIDOMSVGMatrix *secondMatrix,
@@ -223,49 +229,55 @@ NS_IMETHODIMP nsSVGMatrix::Inverse(nsIDO
                          (float)( mD/det),             (float)(-mB/det),
                          (float)(-mC/det),             (float)( mA/det),
                          (float)((mC*mF - mE*mD)/det), (float)((mE*mB - mA*mF)/det));
 }
 
 /* nsIDOMSVGMatrix translate (in float x, in float y); */
 NS_IMETHODIMP nsSVGMatrix::Translate(float x, float y, nsIDOMSVGMatrix **_retval)
 {
+  NS_ENSURE_FINITE2(x, y, NS_ERROR_ILLEGAL_VALUE);
   return NS_NewSVGMatrix(_retval,
                          mA,               mB,
                          mC,               mD,
                          mA*x + mC*y + mE, mB*x + mD*y + mF);
 }
 
 /* nsIDOMSVGMatrix scale (in float scaleFactor); */
 NS_IMETHODIMP nsSVGMatrix::Scale(float scaleFactor, nsIDOMSVGMatrix **_retval)
 {
+  NS_ENSURE_FINITE(scaleFactor, NS_ERROR_ILLEGAL_VALUE);
   return NS_NewSVGMatrix(_retval,
                          mA*scaleFactor, mB*scaleFactor,
                          mC*scaleFactor, mD*scaleFactor,
                          mE,             mF);  
 }
 
 /* nsIDOMSVGMatrix scaleNonUniform (in float scaleFactorX, in float scaleFactorY); */
 NS_IMETHODIMP nsSVGMatrix::ScaleNonUniform(float scaleFactorX, float scaleFactorY, nsIDOMSVGMatrix **_retval)
 {
+  NS_ENSURE_FINITE2(scaleFactorX, scaleFactorY, NS_ERROR_ILLEGAL_VALUE);
   return NS_NewSVGMatrix(_retval,
                          mA*scaleFactorX, mB*scaleFactorX,
                          mC*scaleFactorY, mD*scaleFactorY,
                          mE,              mF);  
 }
 
 /* nsIDOMSVGMatrix rotate (in float angle); */
 NS_IMETHODIMP nsSVGMatrix::Rotate(float angle, nsIDOMSVGMatrix **_retval)
 {
+  NS_ENSURE_FINITE(angle, NS_ERROR_ILLEGAL_VALUE);
   return RotateRadians(angle*radPerDegree, _retval);
 }
 
 /* nsIDOMSVGMatrix rotateFromVector (in float x, in float y); */
 NS_IMETHODIMP nsSVGMatrix::RotateFromVector(float x, float y, nsIDOMSVGMatrix **_retval)
 {
+  NS_ENSURE_FINITE2(x, y, NS_ERROR_ILLEGAL_VALUE);
+
   if (x == 0.0 || y == 0.0)
     return NS_ERROR_DOM_SVG_INVALID_VALUE_ERR;
 
   double rad = atan2(y, x);
 
   return RotateRadians(rad, _retval);
 }
 
@@ -285,27 +297,31 @@ NS_IMETHODIMP nsSVGMatrix::FlipY(nsIDOMS
                            mA,  mB,
                           -mC, -mD,
                            mE,  mF);
 }
 
 /* nsIDOMSVGMatrix skewX (in float angle); */
 NS_IMETHODIMP nsSVGMatrix::SkewX(float angle, nsIDOMSVGMatrix **_retval)
 {
+  NS_ENSURE_FINITE(angle, NS_ERROR_ILLEGAL_VALUE);
+
   double ta = tan( angle*radPerDegree );
 
   return NS_NewSVGMatrix(_retval,
                          mA,                    mB,
                          (float) ( mC + mA*ta), (float) ( mD + mB*ta),
                          mE,                    mF);
 }
 
 /* nsIDOMSVGMatrix skewY (in float angle); */
 NS_IMETHODIMP nsSVGMatrix::SkewY(float angle, nsIDOMSVGMatrix **_retval)
 {
+  NS_ENSURE_FINITE(angle, NS_ERROR_ILLEGAL_VALUE);
+
   double ta = tan( angle*radPerDegree );
 
   return NS_NewSVGMatrix(_retval,
                          (float) (mA + mC*ta), (float) (mB + mD*ta),
                          mC,                    mD,
                          mE,                    mF);
 }
 
--- a/content/svg/content/src/nsSVGNumber.cpp
+++ b/content/svg/content/src/nsSVGNumber.cpp
@@ -159,13 +159,14 @@ nsSVGNumber::SetValueString(const nsAStr
 /* attribute float value; */
 NS_IMETHODIMP nsSVGNumber::GetValue(float *aValue)
 {
   *aValue = mValue;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGNumber::SetValue(float aValue)
 {
+  NS_ENSURE_FINITE(aValue, NS_ERROR_ILLEGAL_VALUE);
   WillModify();
   mValue = aValue;
   DidModify();
   return NS_OK;
 }
--- a/content/svg/content/src/nsSVGNumber2.h
+++ b/content/svg/content/src/nsSVGNumber2.h
@@ -79,16 +79,20 @@ private:
       : mVal(aVal), mSVGElement(aSVGElement) {}
 
     nsSVGNumber2* mVal; // kept alive because it belongs to content
     nsRefPtr<nsSVGElement> mSVGElement;
 
     NS_IMETHOD GetBaseVal(float* aResult)
       { *aResult = mVal->GetBaseValue(); return NS_OK; }
     NS_IMETHOD SetBaseVal(float aValue)
-      { mVal->SetBaseValue(aValue, mSVGElement, PR_TRUE); return NS_OK; }
+      {
+        NS_ENSURE_FINITE(aValue, NS_ERROR_ILLEGAL_VALUE);
+        mVal->SetBaseValue(aValue, mSVGElement, PR_TRUE);
+        return NS_OK;
+      }
     NS_IMETHOD GetAnimVal(float* aResult)
       { *aResult = mVal->GetAnimValue(); return NS_OK; }
 
   };
 
 };
 #endif //__NS_SVGNUMBER2_H__
--- a/content/svg/content/src/nsSVGPathElement.cpp
+++ b/content/svg/content/src/nsSVGPathElement.cpp
@@ -113,16 +113,18 @@ nsSVGPathElement::GetTotalLength(float *
 
   return NS_OK;
 }
 
 /* nsIDOMSVGPoint getPointAtLength (in float distance); */
 NS_IMETHODIMP
 nsSVGPathElement::GetPointAtLength(float distance, nsIDOMSVGPoint **_retval)
 {
+  NS_ENSURE_FINITE(distance, NS_ERROR_ILLEGAL_VALUE);
+
   nsRefPtr<gfxFlattenedPath> flat = GetFlattenedPath(nsnull);
   if (!flat)
     return NS_ERROR_FAILURE;
 
   float totalLength = flat->GetLength();
   if (HasAttr(kNameSpaceID_None, nsGkAtoms::pathLength)) {
     float pathLength = mPathLength.GetAnimValue();
     distance *= totalLength / pathLength;
@@ -132,16 +134,18 @@ nsSVGPathElement::GetPointAtLength(float
 
   return NS_NewSVGPoint(_retval, flat->FindPoint(gfxPoint(distance, 0)));
 }
 
 /* unsigned long getPathSegAtLength (in float distance); */
 NS_IMETHODIMP
 nsSVGPathElement::GetPathSegAtLength(float distance, PRUint32 *_retval)
 {
+  NS_ENSURE_FINITE(distance, NS_ERROR_ILLEGAL_VALUE);
+
   //Check if mSegments is null
   nsresult rv = CreatePathSegList();
   NS_ENSURE_SUCCESS(rv, rv);
 
   PRUint32 i = 0, numSegments;
   float distCovered = 0;
   nsSVGPathSegTraversalState ts;
 
@@ -179,171 +183,189 @@ nsSVGPathElement::CreateSVGPathSegCloseP
   NS_ENSURE_TRUE(seg, NS_ERROR_OUT_OF_MEMORY);
   return CallQueryInterface(seg, _retval);
 }
 
 /* nsIDOMSVGPathSegMovetoAbs createSVGPathSegMovetoAbs (in float x, in float y); */
 NS_IMETHODIMP
 nsSVGPathElement::CreateSVGPathSegMovetoAbs(float x, float y, nsIDOMSVGPathSegMovetoAbs **_retval)
 {
+  NS_ENSURE_FINITE2(x, y, NS_ERROR_ILLEGAL_VALUE);
   nsIDOMSVGPathSeg* seg = NS_NewSVGPathSegMovetoAbs(x, y);
   NS_ENSURE_TRUE(seg, NS_ERROR_OUT_OF_MEMORY);
   return CallQueryInterface(seg, _retval);
 }
 
 /* nsIDOMSVGPathSegMovetoRel createSVGPathSegMovetoRel (in float x, in float y); */
 NS_IMETHODIMP
 nsSVGPathElement::CreateSVGPathSegMovetoRel(float x, float y, nsIDOMSVGPathSegMovetoRel **_retval)
 {
+  NS_ENSURE_FINITE2(x, y, NS_ERROR_ILLEGAL_VALUE);
   nsIDOMSVGPathSeg* seg = NS_NewSVGPathSegMovetoRel(x, y);
   NS_ENSURE_TRUE(seg, NS_ERROR_OUT_OF_MEMORY);
   return CallQueryInterface(seg, _retval);
 }
 
 /* nsIDOMSVGPathSegLinetoAbs createSVGPathSegLinetoAbs (in float x, in float y); */
 NS_IMETHODIMP
 nsSVGPathElement::CreateSVGPathSegLinetoAbs(float x, float y, nsIDOMSVGPathSegLinetoAbs **_retval)
 {
+  NS_ENSURE_FINITE2(x, y, NS_ERROR_ILLEGAL_VALUE);
   nsIDOMSVGPathSeg* seg = NS_NewSVGPathSegLinetoAbs(x, y);
   NS_ENSURE_TRUE(seg, NS_ERROR_OUT_OF_MEMORY);
   return CallQueryInterface(seg, _retval);
 }
 
 /* nsIDOMSVGPathSegLinetoRel createSVGPathSegLinetoRel (in float x, in float y); */
 NS_IMETHODIMP
 nsSVGPathElement::CreateSVGPathSegLinetoRel(float x, float y, nsIDOMSVGPathSegLinetoRel **_retval)
 {
+  NS_ENSURE_FINITE2(x, y, NS_ERROR_ILLEGAL_VALUE);
   nsIDOMSVGPathSeg* seg = NS_NewSVGPathSegLinetoRel(x, y);
   NS_ENSURE_TRUE(seg, NS_ERROR_OUT_OF_MEMORY);
   return CallQueryInterface(seg, _retval);
 }
 
 /* nsIDOMSVGPathSegCurvetoCubicAbs createSVGPathSegCurvetoCubicAbs (in float x, in float y, in float x1, in float y1, in float x2, in float y2); */
 NS_IMETHODIMP
 nsSVGPathElement::CreateSVGPathSegCurvetoCubicAbs(float x, float y, float x1, float y1, float x2, float y2, nsIDOMSVGPathSegCurvetoCubicAbs **_retval)
 {
+  NS_ENSURE_FINITE6(x, y, x1, y1, x2, y2, NS_ERROR_ILLEGAL_VALUE);
   nsIDOMSVGPathSeg* seg = NS_NewSVGPathSegCurvetoCubicAbs(x, y, x1, y1, x2, y2);
   NS_ENSURE_TRUE(seg, NS_ERROR_OUT_OF_MEMORY);
   return CallQueryInterface(seg, _retval);
 }
 
 /* nsIDOMSVGPathSegCurvetoCubicRel createSVGPathSegCurvetoCubicRel (in float x, in float y, in float x1, in float y1, in float x2, in float y2); */
 NS_IMETHODIMP
 nsSVGPathElement::CreateSVGPathSegCurvetoCubicRel(float x, float y, float x1, float y1, float x2, float y2, nsIDOMSVGPathSegCurvetoCubicRel **_retval)
 {
+  NS_ENSURE_FINITE6(x, y, x1, y1, x2, y2, NS_ERROR_ILLEGAL_VALUE);
   nsIDOMSVGPathSeg* seg = NS_NewSVGPathSegCurvetoCubicRel(x, y, x1, y1, x2, y2);
   NS_ENSURE_TRUE(seg, NS_ERROR_OUT_OF_MEMORY);
   return CallQueryInterface(seg, _retval);
 }
 
 /* nsIDOMSVGPathSegCurvetoQuadraticAbs createSVGPathSegCurvetoQuadraticAbs (in float x, in float y, in float x1, in float y1); */
 NS_IMETHODIMP
 nsSVGPathElement::CreateSVGPathSegCurvetoQuadraticAbs(float x, float y, float x1, float y1, nsIDOMSVGPathSegCurvetoQuadraticAbs **_retval)
 {
+  NS_ENSURE_FINITE4(x, y, x1, y1, NS_ERROR_ILLEGAL_VALUE);
   nsIDOMSVGPathSeg* seg = NS_NewSVGPathSegCurvetoQuadraticAbs(x, y, x1, y1);
   NS_ENSURE_TRUE(seg, NS_ERROR_OUT_OF_MEMORY);
   return CallQueryInterface(seg, _retval);
 }
 
 /* nsIDOMSVGPathSegCurvetoQuadraticRel createSVGPathSegCurvetoQuadraticRel (in float x, in float y, in float x1, in float y1); */
 NS_IMETHODIMP
 nsSVGPathElement::CreateSVGPathSegCurvetoQuadraticRel(float x, float y, float x1, float y1, nsIDOMSVGPathSegCurvetoQuadraticRel **_retval)
 {
+  NS_ENSURE_FINITE4(x, y, x1, y1, NS_ERROR_ILLEGAL_VALUE);
   nsIDOMSVGPathSeg* seg = NS_NewSVGPathSegCurvetoQuadraticRel(x, y, x1, y1);
   NS_ENSURE_TRUE(seg, NS_ERROR_OUT_OF_MEMORY);
   return CallQueryInterface(seg, _retval);
 }
 
 /* nsIDOMSVGPathSegArcAbs createSVGPathSegArcAbs (in float x, in float y, in float r1, in float r2, in float angle, in boolean largeArcFlag, in boolean sweepFlag); */
 NS_IMETHODIMP
 nsSVGPathElement::CreateSVGPathSegArcAbs(float x, float y, float r1, float r2, float angle, PRBool largeArcFlag, PRBool sweepFlag, nsIDOMSVGPathSegArcAbs **_retval)
 {
+  NS_ENSURE_FINITE5(x, y, r1, r2, angle, NS_ERROR_ILLEGAL_VALUE);
   nsIDOMSVGPathSeg* seg = NS_NewSVGPathSegArcAbs(x, y, r1, r2, angle,
                                                  largeArcFlag, sweepFlag);
   NS_ENSURE_TRUE(seg, NS_ERROR_OUT_OF_MEMORY);
   return CallQueryInterface(seg, _retval);
 }
 
 /* nsIDOMSVGPathSegArcRel createSVGPathSegArcRel (in float x, in float y, in float r1, in float r2, in float angle, in boolean largeArcFlag, in boolean sweepFlag); */
 NS_IMETHODIMP
 nsSVGPathElement::CreateSVGPathSegArcRel(float x, float y, float r1, float r2, float angle, PRBool largeArcFlag, PRBool sweepFlag, nsIDOMSVGPathSegArcRel **_retval)
 {
+  NS_ENSURE_FINITE5(x, y, r1, r2, angle, NS_ERROR_ILLEGAL_VALUE);
   nsIDOMSVGPathSeg* seg = NS_NewSVGPathSegArcRel(x, y, r1, r2, angle,
                                                  largeArcFlag, sweepFlag);
   NS_ENSURE_TRUE(seg, NS_ERROR_OUT_OF_MEMORY);
   return CallQueryInterface(seg, _retval);
 }
 
 /* nsIDOMSVGPathSegLinetoHorizontalAbs createSVGPathSegLinetoHorizontalAbs (in float x); */
 NS_IMETHODIMP
 nsSVGPathElement::CreateSVGPathSegLinetoHorizontalAbs(float x, nsIDOMSVGPathSegLinetoHorizontalAbs **_retval)
 {
+  NS_ENSURE_FINITE(x, NS_ERROR_ILLEGAL_VALUE);
   nsIDOMSVGPathSeg* seg = NS_NewSVGPathSegLinetoHorizontalAbs(x);
   NS_ENSURE_TRUE(seg, NS_ERROR_OUT_OF_MEMORY);
   return CallQueryInterface(seg, _retval);
 }
 
 /* nsIDOMSVGPathSegLinetoHorizontalRel createSVGPathSegLinetoHorizontalRel (in float x); */
 NS_IMETHODIMP
 nsSVGPathElement::CreateSVGPathSegLinetoHorizontalRel(float x, nsIDOMSVGPathSegLinetoHorizontalRel **_retval)
 {
+  NS_ENSURE_FINITE(x, NS_ERROR_ILLEGAL_VALUE);
   nsIDOMSVGPathSeg* seg = NS_NewSVGPathSegLinetoHorizontalRel(x);
   NS_ENSURE_TRUE(seg, NS_ERROR_OUT_OF_MEMORY);
   return CallQueryInterface(seg, _retval);
 }
 
 /* nsIDOMSVGPathSegLinetoVerticalAbs createSVGPathSegLinetoVerticalAbs (in float y); */
 NS_IMETHODIMP
 nsSVGPathElement::CreateSVGPathSegLinetoVerticalAbs(float y, nsIDOMSVGPathSegLinetoVerticalAbs **_retval)
 {
+  NS_ENSURE_FINITE(y, NS_ERROR_ILLEGAL_VALUE);
   nsIDOMSVGPathSeg* seg = NS_NewSVGPathSegLinetoVerticalAbs(y);
   NS_ENSURE_TRUE(seg, NS_ERROR_OUT_OF_MEMORY);
   return CallQueryInterface(seg, _retval);
 }
 
 /* nsIDOMSVGPathSegLinetoVerticalRel createSVGPathSegLinetoVerticalRel (in float y); */
 NS_IMETHODIMP
 nsSVGPathElement::CreateSVGPathSegLinetoVerticalRel(float y, nsIDOMSVGPathSegLinetoVerticalRel **_retval)
 {
+  NS_ENSURE_FINITE(y, NS_ERROR_ILLEGAL_VALUE);
   nsIDOMSVGPathSeg* seg = NS_NewSVGPathSegLinetoVerticalRel(y);
   NS_ENSURE_TRUE(seg, NS_ERROR_OUT_OF_MEMORY);
   return CallQueryInterface(seg, _retval);
 }
 
 /* nsIDOMSVGPathSegCurvetoCubicSmoothAbs createSVGPathSegCurvetoCubicSmoothAbs (in float x, in float y, in float x2, in float y2); */
 NS_IMETHODIMP
 nsSVGPathElement::CreateSVGPathSegCurvetoCubicSmoothAbs(float x, float y, float x2, float y2, nsIDOMSVGPathSegCurvetoCubicSmoothAbs **_retval)
 {
+  NS_ENSURE_FINITE4(x, y, x2, y2, NS_ERROR_ILLEGAL_VALUE);
   nsIDOMSVGPathSeg* seg = NS_NewSVGPathSegCurvetoCubicSmoothAbs(x, y, x2, y2);
   NS_ENSURE_TRUE(seg, NS_ERROR_OUT_OF_MEMORY);
   return CallQueryInterface(seg, _retval);
 }
 
 /* nsIDOMSVGPathSegCurvetoCubicSmoothRel createSVGPathSegCurvetoCubicSmoothRel (in float x, in float y, in float x2, in float y2); */
 NS_IMETHODIMP
 nsSVGPathElement::CreateSVGPathSegCurvetoCubicSmoothRel(float x, float y, float x2, float y2, nsIDOMSVGPathSegCurvetoCubicSmoothRel **_retval)
 {
+  NS_ENSURE_FINITE4(x, y, x2, y2, NS_ERROR_ILLEGAL_VALUE);
   nsIDOMSVGPathSeg* seg = NS_NewSVGPathSegCurvetoCubicSmoothRel(x, y, x2, y2);
   NS_ENSURE_TRUE(seg, NS_ERROR_OUT_OF_MEMORY);
   return CallQueryInterface(seg, _retval);
 }
 
 /* nsIDOMSVGPathSegCurvetoQuadraticSmoothAbs createSVGPathSegCurvetoQuadraticSmoothAbs (in float x, in float y); */
 NS_IMETHODIMP
 nsSVGPathElement::CreateSVGPathSegCurvetoQuadraticSmoothAbs(float x, float y, nsIDOMSVGPathSegCurvetoQuadraticSmoothAbs **_retval)
 {
+  NS_ENSURE_FINITE2(x, y, NS_ERROR_ILLEGAL_VALUE);
   nsIDOMSVGPathSeg* seg = NS_NewSVGPathSegCurvetoQuadraticSmoothAbs(x, y);
   NS_ENSURE_TRUE(seg, NS_ERROR_OUT_OF_MEMORY);
   return CallQueryInterface(seg, _retval);
 }
 
 /* nsIDOMSVGPathSegCurvetoQuadraticSmoothRel createSVGPathSegCurvetoQuadraticSmoothRel (in float x, in float y); */
 NS_IMETHODIMP
 nsSVGPathElement::CreateSVGPathSegCurvetoQuadraticSmoothRel(float x, float y, nsIDOMSVGPathSegCurvetoQuadraticSmoothRel **_retval)
 {
+  NS_ENSURE_FINITE2(x, y, NS_ERROR_ILLEGAL_VALUE);
   nsIDOMSVGPathSeg* seg = NS_NewSVGPathSegCurvetoQuadraticSmoothRel(x, y);
   NS_ENSURE_TRUE(seg, NS_ERROR_OUT_OF_MEMORY);
   return CallQueryInterface(seg, _retval);
 }
 
 nsresult
 nsSVGPathElement::CreatePathSegList()
 {
--- a/content/svg/content/src/nsSVGPathSeg.cpp
+++ b/content/svg/content/src/nsSVGPathSeg.cpp
@@ -317,29 +317,31 @@ nsSVGPathSegMovetoAbs::GetLength(nsSVGPa
 /* attribute float x; */
 NS_IMETHODIMP nsSVGPathSegMovetoAbs::GetX(float *aX)
 {
   *aX = mX;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegMovetoAbs::SetX(float aX)
 {
+  NS_ENSURE_FINITE(aX, NS_ERROR_ILLEGAL_VALUE);
   mX = aX;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y; */
 NS_IMETHODIMP nsSVGPathSegMovetoAbs::GetY(float *aY)
 {
   *aY = mY;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegMovetoAbs::SetY(float aY)
 {
+  NS_ENSURE_FINITE(aY, NS_ERROR_ILLEGAL_VALUE);
   mY = aY;
   DidModify();
   return NS_OK;
 }
 
 
 ////////////////////////////////////////////////////////////////////////
 // nsSVGPathSegMovetoRel
@@ -411,29 +413,31 @@ nsSVGPathSegMovetoRel::GetLength(nsSVGPa
 /* attribute float x; */
 NS_IMETHODIMP nsSVGPathSegMovetoRel::GetX(float *aX)
 {
   *aX = mX;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegMovetoRel::SetX(float aX)
 {
+  NS_ENSURE_FINITE(aX, NS_ERROR_ILLEGAL_VALUE);
   mX = aX;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y; */
 NS_IMETHODIMP nsSVGPathSegMovetoRel::GetY(float *aY)
 {
   *aY = mY;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegMovetoRel::SetY(float aY)
 {
+  NS_ENSURE_FINITE(aY, NS_ERROR_ILLEGAL_VALUE);
   mY = aY;
   DidModify();
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////
 // nsSVGPathSegLinetoAbs
 
@@ -506,29 +510,31 @@ nsSVGPathSegLinetoAbs::GetLength(nsSVGPa
 /* attribute float x; */
 NS_IMETHODIMP nsSVGPathSegLinetoAbs::GetX(float *aX)
 {
   *aX = mX;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegLinetoAbs::SetX(float aX)
 {
+  NS_ENSURE_FINITE(aX, NS_ERROR_ILLEGAL_VALUE);
   mX = aX;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y; */
 NS_IMETHODIMP nsSVGPathSegLinetoAbs::GetY(float *aY)
 {
   *aY = mY;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegLinetoAbs::SetY(float aY)
 {
+  NS_ENSURE_FINITE(aY, NS_ERROR_ILLEGAL_VALUE);
   mY = aY;
   DidModify();
   return NS_OK;
 }
 
 
 ////////////////////////////////////////////////////////////////////////
 // nsSVGPathSegLinetoRel
@@ -600,29 +606,31 @@ nsSVGPathSegLinetoRel::GetLength(nsSVGPa
 /* attribute float x; */
 NS_IMETHODIMP nsSVGPathSegLinetoRel::GetX(float *aX)
 {
   *aX = mX;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegLinetoRel::SetX(float aX)
 {
+  NS_ENSURE_FINITE(aX, NS_ERROR_ILLEGAL_VALUE);
   mX = aX;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y; */
 NS_IMETHODIMP nsSVGPathSegLinetoRel::GetY(float *aY)
 {
   *aY = mY;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegLinetoRel::SetY(float aY)
 {
+  NS_ENSURE_FINITE(aY, NS_ERROR_ILLEGAL_VALUE);
   mY = aY;
   DidModify();
   return NS_OK;
 }
 
 
 ////////////////////////////////////////////////////////////////////////
 // nsSVGPathSegCurvetoCubicAbs
@@ -709,81 +717,87 @@ nsSVGPathSegCurvetoCubicAbs::GetLength(n
 /* attribute float x; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicAbs::GetX(float *aX)
 {
   *aX = mX;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicAbs::SetX(float aX)
 {
+  NS_ENSURE_FINITE(aX, NS_ERROR_ILLEGAL_VALUE);
   mX = aX;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicAbs::GetY(float *aY)
 {
   *aY = mY;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicAbs::SetY(float aY)
 {
+  NS_ENSURE_FINITE(aY, NS_ERROR_ILLEGAL_VALUE);
   mY = aY;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float x1; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicAbs::GetX1(float *aX1)
 {
   *aX1 = mX1;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicAbs::SetX1(float aX1)
 {
+  NS_ENSURE_FINITE(aX1, NS_ERROR_ILLEGAL_VALUE);
   mX1 = aX1;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y1; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicAbs::GetY1(float *aY1)
 {
   *aY1 = mY1;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicAbs::SetY1(float aY1)
 {
+  NS_ENSURE_FINITE(aY1, NS_ERROR_ILLEGAL_VALUE);
   mY1 = aY1;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float x2; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicAbs::GetX2(float *aX2)
 {
   *aX2 = mX2;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicAbs::SetX2(float aX2)
 {
+  NS_ENSURE_FINITE(aX2, NS_ERROR_ILLEGAL_VALUE);
   mX2 = aX2;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y2; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicAbs::GetY2(float *aY2)
 {
   *aY2 = mY2;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicAbs::SetY2(float aY2)
 {
+  NS_ENSURE_FINITE(aY2, NS_ERROR_ILLEGAL_VALUE);
   mY2 = aY2;
   DidModify();
   return NS_OK;
 }
 
 
 ////////////////////////////////////////////////////////////////////////
 // nsSVGPathSegCurvetoCubicRel
@@ -867,81 +881,87 @@ nsSVGPathSegCurvetoCubicRel::GetLength(n
 /* attribute float x; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicRel::GetX(float *aX)
 {
   *aX = mX;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicRel::SetX(float aX)
 {
+  NS_ENSURE_FINITE(aX, NS_ERROR_ILLEGAL_VALUE);
   mX = aX;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicRel::GetY(float *aY)
 {
   *aY = mY;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicRel::SetY(float aY)
 {
+  NS_ENSURE_FINITE(aY, NS_ERROR_ILLEGAL_VALUE);
   mY = aY;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float x1; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicRel::GetX1(float *aX1)
 {
   *aX1 = mX1;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicRel::SetX1(float aX1)
 {
+  NS_ENSURE_FINITE(aX1, NS_ERROR_ILLEGAL_VALUE);
   mX1 = aX1;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y1; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicRel::GetY1(float *aY1)
 {
   *aY1 = mY1;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicRel::SetY1(float aY1)
 {
+  NS_ENSURE_FINITE(aY1, NS_ERROR_ILLEGAL_VALUE);
   mY1 = aY1;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float x2; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicRel::GetX2(float *aX2)
 {
   *aX2 = mX2;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicRel::SetX2(float aX2)
 {
+  NS_ENSURE_FINITE(aX2, NS_ERROR_ILLEGAL_VALUE);
   mX2 = aX2;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y2; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicRel::GetY2(float *aY2)
 {
   *aY2 = mY2;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicRel::SetY2(float aY2)
 {
+  NS_ENSURE_FINITE(aY2, NS_ERROR_ILLEGAL_VALUE);
   mY2 = aY2;
   DidModify();
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////
 // nsSVGPathSegCurvetoQuadraticAbs
 
@@ -1022,55 +1042,59 @@ nsSVGPathSegCurvetoQuadraticAbs::GetLeng
 /* attribute float x; */
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticAbs::GetX(float *aX)
 {
   *aX = mX;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticAbs::SetX(float aX)
 {
+  NS_ENSURE_FINITE(aX, NS_ERROR_ILLEGAL_VALUE);
   mX = aX;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y; */
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticAbs::GetY(float *aY)
 {
   *aY = mY;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticAbs::SetY(float aY)
 {
+  NS_ENSURE_FINITE(aY, NS_ERROR_ILLEGAL_VALUE);
   mY = aY;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float x1; */
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticAbs::GetX1(float *aX1)
 {
   *aX1 = mX1;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticAbs::SetX1(float aX1)
 {
+  NS_ENSURE_FINITE(aX1, NS_ERROR_ILLEGAL_VALUE);
   mX1 = aX1;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y1; */
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticAbs::GetY1(float *aY1)
 {
   *aY1 = mY1;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticAbs::SetY1(float aY1)
 {
+  NS_ENSURE_FINITE(aY1, NS_ERROR_ILLEGAL_VALUE);
   mY1 = aY1;
   DidModify();
   return NS_OK;
 }
 
 
 ////////////////////////////////////////////////////////////////////////
 // nsSVGPathSegCurvetoQuadraticRel
@@ -1153,55 +1177,59 @@ nsSVGPathSegCurvetoQuadraticRel::GetLeng
 /* attribute float x; */
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticRel::GetX(float *aX)
 {
   *aX = mX;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticRel::SetX(float aX)
 {
+  NS_ENSURE_FINITE(aX, NS_ERROR_ILLEGAL_VALUE);
   mX = aX;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y; */
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticRel::GetY(float *aY)
 {
   *aY = mY;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticRel::SetY(float aY)
 {
+  NS_ENSURE_FINITE(aY, NS_ERROR_ILLEGAL_VALUE);
   mY = aY;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float x1; */
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticRel::GetX1(float *aX1)
 {
   *aX1 = mX1;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticRel::SetX1(float aX1)
 {
+  NS_ENSURE_FINITE(aX1, NS_ERROR_ILLEGAL_VALUE);
   mX1 = aX1;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y1; */
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticRel::GetY1(float *aY1)
 {
   *aY1 = mY1;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticRel::SetY1(float aY1)
 {
+  NS_ENSURE_FINITE(aY1, NS_ERROR_ILLEGAL_VALUE);
   mY1 = aY1;
   DidModify();
   return NS_OK;
 }
 
 
 ////////////////////////////////////////////////////////////////////////
 // nsSVGPathSegArcAbs
@@ -1295,69 +1323,74 @@ nsSVGPathSegArcAbs::GetLength(nsSVGPathS
 /* attribute float x; */
 NS_IMETHODIMP nsSVGPathSegArcAbs::GetX(float *aX)
 {
   *aX = mX;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegArcAbs::SetX(float aX)
 {
+  NS_ENSURE_FINITE(aX, NS_ERROR_ILLEGAL_VALUE);
   mX = aX;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y; */
 NS_IMETHODIMP nsSVGPathSegArcAbs::GetY(float *aY)
 {
   *aY = mY;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegArcAbs::SetY(float aY)
 {
+  NS_ENSURE_FINITE(aY, NS_ERROR_ILLEGAL_VALUE);
   mY = aY;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float r1; */
 NS_IMETHODIMP nsSVGPathSegArcAbs::GetR1(float *aR1)
 {
   *aR1 = mR1;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegArcAbs::SetR1(float aR1)
 {
+  NS_ENSURE_FINITE(aR1, NS_ERROR_ILLEGAL_VALUE);
   mR1 = aR1;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float r2; */
 NS_IMETHODIMP nsSVGPathSegArcAbs::GetR2(float *aR2)
 {
   *aR2 = mR2;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegArcAbs::SetR2(float aR2)
 {
+  NS_ENSURE_FINITE(aR2, NS_ERROR_ILLEGAL_VALUE);
   mR2 = aR2;
   DidModify();
   return NS_OK;
 }
 
 
 /* attribute float angle; */
 NS_IMETHODIMP nsSVGPathSegArcAbs::GetAngle(float *aAngle)
 {
   *aAngle = mAngle;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegArcAbs::SetAngle(float aAngle)
 {
+  NS_ENSURE_FINITE(aAngle, NS_ERROR_ILLEGAL_VALUE);
   mAngle = aAngle;
   DidModify();
   return NS_OK;
 }
 
 /* attribute boolean largeArcFlag; */
 NS_IMETHODIMP nsSVGPathSegArcAbs::GetLargeArcFlag(PRBool *aLargeArcFlag)
 {
@@ -1476,69 +1509,74 @@ nsSVGPathSegArcRel::GetLength(nsSVGPathS
 /* attribute float x; */
 NS_IMETHODIMP nsSVGPathSegArcRel::GetX(float *aX)
 {
   *aX = mX;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegArcRel::SetX(float aX)
 {
+  NS_ENSURE_FINITE(aX, NS_ERROR_ILLEGAL_VALUE);
   mX = aX;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y; */
 NS_IMETHODIMP nsSVGPathSegArcRel::GetY(float *aY)
 {
   *aY = mY;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegArcRel::SetY(float aY)
 {
+  NS_ENSURE_FINITE(aY, NS_ERROR_ILLEGAL_VALUE);
   mY = aY;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float r1; */
 NS_IMETHODIMP nsSVGPathSegArcRel::GetR1(float *aR1)
 {
   *aR1 = mR1;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegArcRel::SetR1(float aR1)
 {
+  NS_ENSURE_FINITE(aR1, NS_ERROR_ILLEGAL_VALUE);
   mR1 = aR1;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float r2; */
 NS_IMETHODIMP nsSVGPathSegArcRel::GetR2(float *aR2)
 {
   *aR2 = mR2;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegArcRel::SetR2(float aR2)
 {
+  NS_ENSURE_FINITE(aR2, NS_ERROR_ILLEGAL_VALUE);
   mR2 = aR2;
   DidModify();
   return NS_OK;
 }
 
 
 /* attribute float angle; */
 NS_IMETHODIMP nsSVGPathSegArcRel::GetAngle(float *aAngle)
 {
   *aAngle = mAngle;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegArcRel::SetAngle(float aAngle)
 {
+  NS_ENSURE_FINITE(aAngle, NS_ERROR_ILLEGAL_VALUE);
   mAngle = aAngle;
   DidModify();
   return NS_OK;
 }
 
 /* attribute boolean largeArcFlag; */
 NS_IMETHODIMP nsSVGPathSegArcRel::GetLargeArcFlag(PRBool *aLargeArcFlag)
 {
@@ -1637,16 +1675,17 @@ nsSVGPathSegLinetoHorizontalAbs::GetLeng
 /* attribute float x; */
 NS_IMETHODIMP nsSVGPathSegLinetoHorizontalAbs::GetX(float *aX)
 {
   *aX = mX;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegLinetoHorizontalAbs::SetX(float aX)
 {
+  NS_ENSURE_FINITE(aX, NS_ERROR_ILLEGAL_VALUE);
   mX = aX;
   DidModify();
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////
 // nsSVGPathSegLinetoHorizontalRel
 
@@ -1718,16 +1757,17 @@ nsSVGPathSegLinetoHorizontalRel::GetLeng
 /* attribute float x; */
 NS_IMETHODIMP nsSVGPathSegLinetoHorizontalRel::GetX(float *aX)
 {
   *aX = mX;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegLinetoHorizontalRel::SetX(float aX)
 {
+  NS_ENSURE_FINITE(aX, NS_ERROR_ILLEGAL_VALUE);
   mX = aX;
   DidModify();
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////
 // nsSVGPathSegLinetoVerticalAbs
 
@@ -1800,16 +1840,17 @@ nsSVGPathSegLinetoVerticalAbs::GetLength
 /* attribute float y; */
 NS_IMETHODIMP nsSVGPathSegLinetoVerticalAbs::GetY(float *aY)
 {
   *aY = mY;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegLinetoVerticalAbs::SetY(float aY)
 {
+  NS_ENSURE_FINITE(aY, NS_ERROR_ILLEGAL_VALUE);
   mY = aY;
   DidModify();
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////
 // nsSVGPathSegLinetoVerticalRel
 
@@ -1882,16 +1923,17 @@ nsSVGPathSegLinetoVerticalRel::GetLength
 /* attribute float y; */
 NS_IMETHODIMP nsSVGPathSegLinetoVerticalRel::GetY(float *aY)
 {
   *aY = mY;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegLinetoVerticalRel::SetY(float aY)
 {
+  NS_ENSURE_FINITE(aY, NS_ERROR_ILLEGAL_VALUE);
   mY = aY;
   DidModify();
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////
 // nsSVGPathSegCurvetoCubicSmoothAbs
 
@@ -1978,55 +2020,59 @@ nsSVGPathSegCurvetoCubicSmoothAbs::GetLe
 /* attribute float x; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicSmoothAbs::GetX(float *aX)
 {
   *aX = mX;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicSmoothAbs::SetX(float aX)
 {
+  NS_ENSURE_FINITE(aX, NS_ERROR_ILLEGAL_VALUE);
   mX = aX;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicSmoothAbs::GetY(float *aY)
 {
   *aY = mY;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicSmoothAbs::SetY(float aY)
 {
+  NS_ENSURE_FINITE(aY, NS_ERROR_ILLEGAL_VALUE);
   mY = aY;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float x2; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicSmoothAbs::GetX2(float *aX2)
 {
   *aX2 = mX2;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicSmoothAbs::SetX2(float aX2)
 {
+  NS_ENSURE_FINITE(aX2, NS_ERROR_ILLEGAL_VALUE);
   mX2 = aX2;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y2; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicSmoothAbs::GetY2(float *aY2)
 {
   *aY2 = mY2;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicSmoothAbs::SetY2(float aY2)
 {
+  NS_ENSURE_FINITE(aY2, NS_ERROR_ILLEGAL_VALUE);
   mY2 = aY2;
   DidModify();
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////
 // nsSVGPathSegCurvetoCubicSmoothRel
 
@@ -2111,55 +2157,59 @@ nsSVGPathSegCurvetoCubicSmoothRel::GetLe
 /* attribute float x; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicSmoothRel::GetX(float *aX)
 {
   *aX = mX;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicSmoothRel::SetX(float aX)
 {
+  NS_ENSURE_FINITE(aX, NS_ERROR_ILLEGAL_VALUE);
   mX = aX;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicSmoothRel::GetY(float *aY)
 {
   *aY = mY;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicSmoothRel::SetY(float aY)
 {
+  NS_ENSURE_FINITE(aY, NS_ERROR_ILLEGAL_VALUE);
   mY = aY;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float x2; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicSmoothRel::GetX2(float *aX2)
 {
   *aX2 = mX2;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicSmoothRel::SetX2(float aX2)
 {
+  NS_ENSURE_FINITE(aX2, NS_ERROR_ILLEGAL_VALUE);
   mX2 = aX2;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y2; */
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicSmoothRel::GetY2(float *aY2)
 {
   *aY2 = mY2;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoCubicSmoothRel::SetY2(float aY2)
 {
+  NS_ENSURE_FINITE(aY2, NS_ERROR_ILLEGAL_VALUE);
   mY2 = aY2;
   DidModify();
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////
 // nsSVGPathSegCurvetoQuadraticSmoothAbs
 
@@ -2238,29 +2288,31 @@ nsSVGPathSegCurvetoQuadraticSmoothAbs::G
 /* attribute float x; */
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticSmoothAbs::GetX(float *aX)
 {
   *aX = mX;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticSmoothAbs::SetX(float aX)
 {
+  NS_ENSURE_FINITE(aX, NS_ERROR_ILLEGAL_VALUE);
   mX = aX;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y; */
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticSmoothAbs::GetY(float *aY)
 {
   *aY = mY;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticSmoothAbs::SetY(float aY)
 {
+  NS_ENSURE_FINITE(aY, NS_ERROR_ILLEGAL_VALUE);
   mY = aY;
   DidModify();
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////
 // nsSVGPathSegCurvetoQuadraticSmoothRel
 
@@ -2342,26 +2394,28 @@ nsSVGPathSegCurvetoQuadraticSmoothRel::G
 /* attribute float x; */
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticSmoothRel::GetX(float *aX)
 {
   *aX = mX;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticSmoothRel::SetX(float aX)
 {
+  NS_ENSURE_FINITE(aX, NS_ERROR_ILLEGAL_VALUE);
   mX = aX;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y; */
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticSmoothRel::GetY(float *aY)
 {
   *aY = mY;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPathSegCurvetoQuadraticSmoothRel::SetY(float aY)
 {
+  NS_ENSURE_FINITE(aY, NS_ERROR_ILLEGAL_VALUE);
   mY = aY;
   DidModify();
   return NS_OK;
 }
 
--- a/content/svg/content/src/nsSVGPoint.cpp
+++ b/content/svg/content/src/nsSVGPoint.cpp
@@ -108,31 +108,35 @@ NS_INTERFACE_MAP_END
 /* attribute float x; */
 NS_IMETHODIMP nsSVGPoint::GetX(float *aX)
 {
   *aX = mX;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPoint::SetX(float aX)
 {
+  NS_ENSURE_FINITE(aX, NS_ERROR_ILLEGAL_VALUE);
+
   WillModify();
   mX = aX;
   DidModify();
   
   return NS_OK;
 }
 
 /* attribute float y; */
 NS_IMETHODIMP nsSVGPoint::GetY(float *aY)
 {
   *aY = mY;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGPoint::SetY(float aY)
 {
+  NS_ENSURE_FINITE(aY, NS_ERROR_ILLEGAL_VALUE);
+
   WillModify();
   mY = aY;
   DidModify();
   
   return NS_OK;
 }
 
 /* nsIDOMSVGPoint matrixTransform (in nsIDOMSVGMatrix matrix); */
--- a/content/svg/content/src/nsSVGRect.cpp
+++ b/content/svg/content/src/nsSVGRect.cpp
@@ -135,58 +135,62 @@ nsSVGRect::GetValueString(nsAString& aVa
 /* attribute float x; */
 NS_IMETHODIMP nsSVGRect::GetX(float *aX)
 {
   *aX = mX;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGRect::SetX(float aX)
 {
+  NS_ENSURE_FINITE(aX, NS_ERROR_ILLEGAL_VALUE);
   WillModify();
   mX = aX;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float y; */
 NS_IMETHODIMP nsSVGRect::GetY(float *aY)
 {
   *aY = mY;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGRect::SetY(float aY)
 {
+  NS_ENSURE_FINITE(aY, NS_ERROR_ILLEGAL_VALUE);
   WillModify();
   mY = aY;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float width; */
 NS_IMETHODIMP nsSVGRect::GetWidth(float *aWidth)
 {
   *aWidth = mWidth;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGRect::SetWidth(float aWidth)
 {
+  NS_ENSURE_FINITE(aWidth, NS_ERROR_ILLEGAL_VALUE);
   WillModify();
   mWidth = aWidth;
   DidModify();
   return NS_OK;
 }
 
 /* attribute float height; */
 NS_IMETHODIMP nsSVGRect::GetHeight(float *aHeight)
 {
   *aHeight = mHeight;
   return NS_OK;
 }
 NS_IMETHODIMP nsSVGRect::SetHeight(float aHeight)
 {
+  NS_ENSURE_FINITE(aHeight, NS_ERROR_ILLEGAL_VALUE);
   WillModify();
   mHeight = aHeight;
   DidModify();
   return NS_OK;
 }
 
 
 
--- a/content/svg/content/src/nsSVGSVGElement.cpp
+++ b/content/svg/content/src/nsSVGSVGElement.cpp
@@ -338,16 +338,18 @@ nsSVGSVGElement::GetCurrentScale(float *
 }
 
 #define CURRENT_SCALE_MAX 16.0f
 #define CURRENT_SCALE_MIN 0.0625f
 
 NS_IMETHODIMP
 nsSVGSVGElement::SetCurrentScale(float aCurrentScale)
 {
+  NS_ENSURE_FINITE(aCurrentScale, NS_ERROR_ILLEGAL_VALUE);
+
   // Prevent bizarre behaviour and maxing out of CPU and memory by clamping
   if (aCurrentScale < CURRENT_SCALE_MIN)
     aCurrentScale = CURRENT_SCALE_MIN;
   else if (aCurrentScale > CURRENT_SCALE_MAX)
     aCurrentScale = CURRENT_SCALE_MAX;
 
   return mCurrentScale->SetValue(aCurrentScale);
 
@@ -476,16 +478,17 @@ nsSVGSVGElement::GetCurrentTime(float *_
   NS_NOTYETIMPLEMENTED("nsSVGSVGElement::GetCurrentTime");
   return NS_ERROR_NOT_IMPLEMENTED;
 }
 
 /* void setCurrentTime (in float seconds); */
 NS_IMETHODIMP
 nsSVGSVGElement::SetCurrentTime(float seconds)
 {
+  NS_ENSURE_FINITE(seconds, NS_ERROR_ILLEGAL_VALUE);
   NS_NOTYETIMPLEMENTED("nsSVGSVGElement::SetCurrentTime");
   return NS_ERROR_NOT_IMPLEMENTED;
 }
 
 /* nsIDOMNodeList getIntersectionList (in nsIDOMSVGRect rect, in nsIDOMSVGElement referenceElement); */
 NS_IMETHODIMP
 nsSVGSVGElement::GetIntersectionList(nsIDOMSVGRect *rect,
                                      nsIDOMSVGElement *referenceElement,
--- a/content/svg/content/src/nsSVGTransform.cpp
+++ b/content/svg/content/src/nsSVGTransform.cpp
@@ -296,16 +296,18 @@ NS_IMETHODIMP nsSVGTransform::SetMatrix(
 
   DidModify();
   return NS_OK;
 }
 
 /* void setTranslate (in float tx, in float ty); */
 NS_IMETHODIMP nsSVGTransform::SetTranslate(float tx, float ty)
 {
+  NS_ENSURE_FINITE2(tx, ty, NS_ERROR_ILLEGAL_VALUE);
+
   WillModify();
   
   mType = SVG_TRANSFORM_TRANSLATE;
   mAngle = 0.0f;
   mOriginX = 0.0f;
   mOriginY = 0.0f;
   mMatrix->SetA(1.0f);
   mMatrix->SetB(0.0f);
@@ -316,16 +318,18 @@ NS_IMETHODIMP nsSVGTransform::SetTransla
 
   DidModify();
   return NS_OK;
 }
 
 /* void setScale (in float sx, in float sy); */
 NS_IMETHODIMP nsSVGTransform::SetScale(float sx, float sy)
 {
+  NS_ENSURE_FINITE2(sx, sy, NS_ERROR_ILLEGAL_VALUE);
+
   WillModify();
   
   mType = SVG_TRANSFORM_SCALE;
   mAngle = 0.0f;
   mOriginX = 0.0f;
   mOriginY = 0.0f;
   mMatrix->SetA(sx);
   mMatrix->SetB(0.0f);
@@ -336,16 +340,18 @@ NS_IMETHODIMP nsSVGTransform::SetScale(f
 
   DidModify();
   return NS_OK;
 }
 
 /* void setRotate (in float angle, in float cx, in float cy); */
 NS_IMETHODIMP nsSVGTransform::SetRotate(float angle, float cx, float cy)
 {
+  NS_ENSURE_FINITE3(angle, cx, cy, NS_ERROR_ILLEGAL_VALUE);
+
   WillModify();
   
   mType = SVG_TRANSFORM_ROTATE;
   mAngle = angle;
   mOriginX = cx;
   mOriginY = cy;
 
   NS_REMOVE_SVGVALUE_OBSERVER(mMatrix);
@@ -361,16 +367,18 @@ NS_IMETHODIMP nsSVGTransform::SetRotate(
 
   DidModify();
   return NS_OK;
 }
 
 /* void setSkewX (in float angle); */
 NS_IMETHODIMP nsSVGTransform::SetSkewX(float angle)
 {
+  NS_ENSURE_FINITE(angle, NS_ERROR_ILLEGAL_VALUE);
+
   WillModify();
   
   mType = SVG_TRANSFORM_SKEWX;
   mAngle = angle;
 
   NS_REMOVE_SVGVALUE_OBSERVER(mMatrix);
   NS_NewSVGMatrix(getter_AddRefs(mMatrix));
   nsCOMPtr<nsIDOMSVGMatrix> temp;
@@ -380,16 +388,18 @@ NS_IMETHODIMP nsSVGTransform::SetSkewX(f
 
   DidModify();
   return NS_OK;
 }
 
 /* void setSkewY (in float angle); */
 NS_IMETHODIMP nsSVGTransform::SetSkewY(float angle)
 {
+  NS_ENSURE_FINITE(angle, NS_ERROR_ILLEGAL_VALUE);
+
   WillModify();
   
   mType = SVG_TRANSFORM_SKEWY;
   mAngle = angle;
 
   NS_REMOVE_SVGVALUE_OBSERVER(mMatrix);
   NS_NewSVGMatrix(getter_AddRefs(mMatrix));
   nsCOMPtr<nsIDOMSVGMatrix> temp;