Avoid wrapping to negative font sizes. (Bug 565248) r=roc

2010-05-13 19:36:48 -07:00 · 2010-05-13 19:36:48 -07:00 · 494c35914d
--- a/layout/style/crashtests/565248-1.html
+++ b/layout/style/crashtests/565248-1.html
@ -0,0 +1,2 @@
+<html><body style="font-size: 18014398509481984%"></body></html>
+
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@ -53,3 +53,4 @@ load 509569-1.html
 load 524252-1.html
 load font-face-truncated-src.html 
 load 536789-1.html
+load 565248-1.html
--- a/layout/style/nsRuleNode.cpp
+++ b/layout/style/nsRuleNode.cpp
@ -2694,7 +2694,8 @@ struct SetFontSizeCalcOps : public mozilla::css::BasicCoordCalcOps,
      // Note that % units use the parent's size unadjusted for scriptlevel
      // changes. A scriptlevel change between us and the parent is simply
      // ignored.
-      size = NSToCoordRound(mParentSize * aValue.GetPercentValue());
+      // aValue.GetPercentValue() may be negative for, e.g., calc(-50%)
+      size = NSCoordSaturatingMultiply(mParentSize, aValue.GetPercentValue());
    } else {
      NS_ABORT_IF_FALSE(PR_FALSE, "unexpected value");
      size = mParentSize;
				`@ -0,0 +1,2 @@`
				`<html><body style="font-size: 18014398509481984%"></body></html>`