Bug 840720 - Check for the finiteness of the values returned from the ToDouble calls in the nsHTMLInputElement code. r=mounir.

content/html/content/src/nsHTMLInputElement.cpp

@@ -1086,7 +1086,7 @@ nsHTMLInputElement::ConvertStringToNumber(nsAString& aValue,
       {
         nsresult ec;
         aResultValue = PromiseFlatString(aValue).ToDouble(&ec);
-        if (NS_FAILED(ec)) {
+        if (NS_FAILED(ec) || !MOZ_DOUBLE_IS_FINITE(aResultValue)) {
           return false;
         }
 
@@ -3074,8 +3074,8 @@ nsHTMLInputElement::SanitizeValue(nsAString& aValue)
     case NS_FORM_INPUT_NUMBER:
       {
         nsresult ec;
-        PromiseFlatString(aValue).ToDouble(&ec);
-        if (NS_FAILED(ec)) {
+        double val = PromiseFlatString(aValue).ToDouble(&ec);
+        if (NS_FAILED(ec) || !MOZ_DOUBLE_IS_FINITE(val)) {
           aValue.Truncate();
         }
       }
@@ -4518,7 +4518,7 @@ nsHTMLInputElement::GetStep() const
 
   nsresult ec;
   double step = stepStr.ToDouble(&ec);
-  if (NS_FAILED(ec) || step <= 0) {
+  if (NS_FAILED(ec) || !MOZ_DOUBLE_IS_FINITE(step) || step <= 0) {
     step = GetDefaultStep();
   }
 

content/html/content/src/nsHTMLInputElement.h

@@ -663,7 +663,8 @@ protected:
    * Returns the input's "minimum" (as defined by the HTML5 spec) as a double.
    * Note this takes account of any default minimum that the type may have.
    * Returns NaN if the min attribute isn't a valid floating point number and
-   * the input's type does not have a default minimum.
+   * the input's type does not have a default minimum. Otherwise, guaranteed
+   * to return a finite value.
    *
    * NOTE: Only call this if you know DoesMinMaxApply() returns true.
    */
@@ -673,7 +674,8 @@ protected:
    * Returns the input's "maximum" (as defined by the HTML5 spec) as a double.
    * Note this takes account of any default maximum that the type may have.
    * Returns NaN if the max attribute isn't a valid floating point number and
-   * the input's type does not have a default maximum.
+   * the input's type does not have a default maximum. Otherwise, guaranteed
+   * to return a finite value.
    *
    * NOTE:Only call this if you know DoesMinMaxApply() returns true.
    */