From 6c8c09b78a890ac8c21b4ad292bb81b84d524656 Mon Sep 17 00:00:00 2001
From: "bzbarsky%mit.edu" <bzbarsky%mit.edu>
Date: Tue, 15 Aug 2006 01:08:00 +0000
Subject: [PATCH] Deal with flex values that add up to too much.  Bug 345709,
 r=neil, sr=roc

---
 layout/style/nsCSSParser.cpp             |  2 +-
 layout/xul/base/src/nsSprocketLayout.cpp | 35 +++++++++++++++++++++---
 2 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/layout/style/nsCSSParser.cpp b/layout/style/nsCSSParser.cpp
index 256a87f53d42..26b363058fc6 100644
--- a/layout/style/nsCSSParser.cpp
+++ b/layout/style/nsCSSParser.cpp
@@ -4423,7 +4423,7 @@ PRBool CSSParserImpl::ParseSingleValueProperty(nsresult& aErrorCode,
     return ParseVariant(aErrorCode, aValue, VARIANT_HK,
                         nsCSSProps::kBoxDirectionKTable);
   case eCSSProperty_box_flex:
-    return ParseVariant(aErrorCode, aValue, VARIANT_HN, nsnull);
+    return ParsePositiveVariant(aErrorCode, aValue, VARIANT_HN, nsnull);
   case eCSSProperty_box_orient:
     return ParseVariant(aErrorCode, aValue, VARIANT_HK,
                         nsCSSProps::kBoxOrientKTable);
diff --git a/layout/xul/base/src/nsSprocketLayout.cpp b/layout/xul/base/src/nsSprocketLayout.cpp
index ef0a7add3169..b5cd3d50fdeb 100644
--- a/layout/xul/base/src/nsSprocketLayout.cpp
+++ b/layout/xul/base/src/nsSprocketLayout.cpp
@@ -803,8 +803,12 @@ nsSprocketLayout::PopulateBoxSizes(nsIBox* aBox, nsBoxLayoutState& aState, nsBox
   currentBox = aBoxSizes;
   nsBoxSize* last = nsnull;
 
+  nscoord maxFlex = 0;
+  PRInt32 childCount = 0;
+
   while(child)
   {
+    ++childCount;
     nsSize pref(0,0);
     nsSize min(0,0);
     nsSize max(NS_INTRINSICSIZE,NS_INTRINSICSIZE);
@@ -864,10 +868,15 @@ nsSprocketLayout::PopulateBoxSizes(nsIBox* aBox, nsBoxLayoutState& aState, nsBox
       child->GetFlex(aState, flex);
 
       // set them if you collapsed you are not flexible.
-      if (collapsed)
-         currentBox->flex = 0;
-      else
-         currentBox->flex = flex;
+      if (collapsed) {
+        currentBox->flex = 0;
+      }
+      else {
+        if (flex > maxFlex) {
+          maxFlex = flex;
+        }
+        currentBox->flex = flex;
+      }
 
       // we specified all our children are equal size;
       if (frameState & NS_STATE_EQUAL_SIZE) {
@@ -916,6 +925,24 @@ nsSprocketLayout::PopulateBoxSizes(nsIBox* aBox, nsBoxLayoutState& aState, nsBox
 
   }
 
+  if (childCount > 0) {
+    nscoord maxAllowedFlex = nscoord_MAX / childCount;
+  
+    if (NS_UNLIKELY(maxFlex > maxAllowedFlex)) {
+      // clamp all the flexes
+      currentBox = aBoxSizes;
+      while (currentBox) {
+        currentBox->flex = PR_MIN(currentBox->flex, maxAllowedFlex);
+        currentBox = currentBox->next;      
+      }
+    }
+  }
+#ifdef DEBUG
+  else {
+    NS_ASSERTION(maxFlex == 0, "How did that happen?");
+  }
+#endif
+
   // we specified all our children are equal size;
   if (frameState & NS_STATE_EQUAL_SIZE) {
     currentBox = aBoxSizes;