Bug 291702 - Crash if a XUL page contains flex summing up to zero - Integer divide by 0 [@ nsSprocketLayout::ComputeChildSizes ], r=neil, sr=bzbarsky

layout/xul/base/src/nsBox.cpp

@@ -1157,6 +1157,11 @@ nsIBox::AddCSSFlex(nsBoxLayoutState& aState, nsIBox* aBox, nscoord& aFlex)
         }
     }
 
+    if (aFlex < 0)
+      aFlex = 0;
+    if (aFlex >= nscoord_MAX)
+      aFlex = nscoord_MAX - 1;
+
     return flexSet;
 }