Bug 1710116 - Use more saturating nscoord arithmetic in BasicTableLay…

…outStrategy::DistributeISizeToColumns. r=emilio This avoids potentially computing col_iSize values greater than nsccoord_MAX, which will confuse a subsequent NSCoordSaturatingSubtract. Differential Revision: https://phabricator.services.mozilla.com/D115684
dothq · May 21, 2021 · 2f61bdc · 2f61bdc
1 parent dce60a0
commit 2f61bdc
Show file tree

Hide file tree

Showing 3 changed files with 36 additions and 9 deletions.
diff --git a/layout/tables/BasicTableLayoutStrategy.cpp b/layout/tables/BasicTableLayoutStrategy.cpp
@@ -720,15 +720,15 @@ void BasicTableLayoutStrategy::DistributeISizeToColumns(
       if (val < min_iSize) {
         val = min_iSize;
       }
-      guess_min_pct += val;
+      guess_min_pct = NSCoordSaturatingAdd(guess_min_pct, val);
       guess_pref = NSCoordSaturatingAdd(guess_pref, val);
     } else {
       nscoord pref_iSize = colFrame->GetPrefCoord();
       if (pref_iSize == nscoord_MAX) {
         ++numInfiniteISizeCols;
       }
       guess_pref = NSCoordSaturatingAdd(guess_pref, pref_iSize);
-      guess_min_pct += min_iSize;
+      guess_min_pct = NSCoordSaturatingAdd(guess_min_pct, min_iSize);
       if (colFrame->GetHasSpecifiedCoord()) {
         // we'll add on the rest of guess_min_spec outside the
         // loop
@@ -849,7 +849,8 @@ void BasicTableLayoutStrategy::DistributeISizeToColumns(
           if (pct_minus_min > 0) {
             float c = float(space) / float(basis.c);
             basis.c -= pct_minus_min;
-            col_iSize += NSToCoordRound(float(pct_minus_min) * c);
+            col_iSize = NSCoordSaturatingAdd(
+                col_iSize, NSToCoordRound(float(pct_minus_min) * c));
           }
         }
         break;
@@ -864,7 +865,8 @@ void BasicTableLayoutStrategy::DistributeISizeToColumns(
             if (pref_minus_min != 0) {
               float c = float(space) / float(basis.c);
               basis.c -= pref_minus_min;
-              col_iSize += NSToCoordRound(float(pref_minus_min) * c);
+              col_iSize = NSCoordSaturatingAdd(
+                  col_iSize, NSToCoordRound(float(pref_minus_min) * c));
             }
           } else
             col_iSize = col_iSize_before_adjust = colFrame->GetMinCoord();
@@ -898,7 +900,8 @@ void BasicTableLayoutStrategy::DistributeISizeToColumns(
             }
             basis.c =
                 NSCoordSaturatingSubtract(basis.c, pref_minus_min, nscoord_MAX);
-            col_iSize += NSToCoordRound(float(pref_minus_min) * c);
+            col_iSize = NSCoordSaturatingAdd(
+                col_iSize, NSToCoordRound(float(pref_minus_min) * c));
           }
         }
         break;
@@ -913,7 +916,8 @@ void BasicTableLayoutStrategy::DistributeISizeToColumns(
             } else {
               float c = float(space) / float(basis.c);
               basis.c -= col_iSize;
-              col_iSize += NSToCoordRound(float(col_iSize) * c);
+              col_iSize = NSCoordSaturatingAdd(
+                  col_iSize, NSToCoordRound(float(col_iSize) * c));
             }
           }
         }
@@ -940,7 +944,8 @@ void BasicTableLayoutStrategy::DistributeISizeToColumns(
           if (col_iSize != 0) {
             float c = float(space) / float(basis.c);
             basis.c -= col_iSize;
-            col_iSize += NSToCoordRound(float(col_iSize) * c);
+            col_iSize = NSCoordSaturatingAdd(
+                col_iSize, NSToCoordRound(float(col_iSize) * c));
           }
         }
         break;
@@ -949,13 +954,13 @@ void BasicTableLayoutStrategy::DistributeISizeToColumns(
                      "wrong case");
         if (pct != 0.0f) {
           float c = float(space) / basis.f;
-          col_iSize += NSToCoordRound(pct * c);
+          col_iSize = NSCoordSaturatingAdd(col_iSize, NSToCoordRound(pct * c));
           basis.f -= pct;
         }
         break;
       case FLEX_ALL_LARGE: {
         float c = float(space) / float(basis.c);
-        col_iSize += NSToCoordRound(c);
+        col_iSize = NSCoordSaturatingAdd(col_iSize, NSToCoordRound(c));
         --basis.c;
       } break;
     }

diff --git a/layout/tables/crashtests/1710116-1.html b/layout/tables/crashtests/1710116-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <style>
+      #tbody {
+          display: inline-flex;
+      }
+
+      * {
+          inline-size: 3579845520.820976vw;
+      }
+  </style>
+</head>
+<table>
+  <td colspan="149">
+    <tbody id="tbody">
+    <col>
+    </tbody>
+  </td>
+</table>
+</html>
diff --git a/layout/tables/crashtests/crashtests.list b/layout/tables/crashtests/crashtests.list
@@ -171,3 +171,4 @@ load 1555757-2.html
 load 1555757-3.html
 load 1555757-4.html
 load 1607045.html
+load 1710116-1.html