From 4751e27983f9adbb732fec3e22117d7b50709617 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Emilio=20Cobos=20=C3=81lvarez?= <emilio@crisal.io>
Date: Mon, 3 May 2021 11:40:26 +0000
Subject: [PATCH] Bug 1707720 - Use saturating addition for math-depth. r=fredw

Differential Revision: https://phabricator.services.mozilla.com/D114070
---
 servo/components/style/values/computed/font.rs         |  4 ++--
 .../tests/mathml/crashtests/math-depth-overflow.html   | 10 ++++++++++
 2 files changed, 12 insertions(+), 2 deletions(-)
 create mode 100644 testing/web-platform/tests/mathml/crashtests/math-depth-overflow.html

diff --git a/servo/components/style/values/computed/font.rs b/servo/components/style/values/computed/font.rs
index df6a8ed667e8..0bd177bcc85f 100644
--- a/servo/components/style/values/computed/font.rs
+++ b/servo/components/style/values/computed/font.rs
@@ -828,14 +828,14 @@ impl ToComputedValue for specified::MathDepth {
                 let parent = cx.builder.get_parent_font().clone_math_depth() as i32;
                 let style = cx.builder.get_parent_font().clone_math_style();
                 if style == MathStyleValue::Compact {
-                    parent + 1
+                    parent.saturating_add(1)
                 } else {
                     parent
                 }
             },
             specified::MathDepth::Add(rel) => {
                 let parent = cx.builder.get_parent_font().clone_math_depth();
-                parent as i32 + rel.to_computed_value(cx)
+                (parent as i32).saturating_add(rel.to_computed_value(cx))
             },
             specified::MathDepth::Absolute(abs) => abs.to_computed_value(cx),
         };
diff --git a/testing/web-platform/tests/mathml/crashtests/math-depth-overflow.html b/testing/web-platform/tests/mathml/crashtests/math-depth-overflow.html
new file mode 100644
index 000000000000..e096dbb55881
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/math-depth-overflow.html
@@ -0,0 +1,10 @@
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+  let a = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'math')
+  a.setAttribute('scriptlevel', '127')
+  let b = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'mstyle')
+  b.setAttribute('scriptlevel', '+2147483645')
+  a.appendChild(b)
+  document.documentElement.appendChild(a)
+})
+</script>