Bug 1772640 - Use NSCoordSaturatingMultiply to avoid overflowing nscoord. r=tnikkel

Differential Revision: https://phabricator.services.mozilla.com/D149838
2022-06-22 01:30:29 +00:00 · 2022-06-22 01:30:29 +00:00 · 41c2d38055
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@ -1293,10 +1293,14 @@ static void GetScrollableOverflowForPerspective(

        // Scale according to rightDelta/bottomDelta to adjust for the different
        // scroll rates.
-        overhang.top /= bottomDelta;
-        overhang.right /= rightDelta;
-        overhang.bottom /= bottomDelta;
-        overhang.left /= rightDelta;
+        overhang.top = NSCoordSaturatingMultiply(
+            overhang.top, static_cast<float>(1 / bottomDelta));
+        overhang.right = NSCoordSaturatingMultiply(
+            overhang.right, static_cast<float>(1 / rightDelta));
+        overhang.bottom = NSCoordSaturatingMultiply(
+            overhang.bottom, static_cast<float>(1 / bottomDelta));
+        overhang.left = NSCoordSaturatingMultiply(
+            overhang.left, static_cast<float>(1 / rightDelta));

        // Take the minimum overflow rect that would allow the current scroll
        // position, using the size of the scroll port and offset by the
--- a/testing/web-platform/tests/css/css-transforms/crashtests/zero-perspective-001.html
+++ b/testing/web-platform/tests/css/css-transforms/crashtests/zero-perspective-001.html
@ -0,0 +1,14 @@
+<!doctype html>
+<meta charset="utf-8">
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1772640">
+<div id="test">
+<style>
+* {
+  overflow-x: scroll;
+  perspective: 0px;
+}
+#a {
+  rotate: 1deg 0 1 0;
+}
+</style>
+<ul id="a">IjzXS</ul>