Bug 1074651 - Detect integer overflow in BaseTimeDuration::TicksFromMilliseconds; r=bz

2014-10-02 15:14:12 +09:00 · 2014-10-02 15:14:12 +09:00 · cf167e36af
--- a/layout/style/crashtests/1074651-1.html
+++ b/layout/style/crashtests/1074651-1.html
@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html style="transition-duration: 500000000000000000ms">
+<body onload="document.documentElement.style.strokeWidth = '17px';"></body>
+</html>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@ -108,5 +108,6 @@ load 992333-1.html
 pref(dom.webcomponents.enabled,true) load 1017798-1.html
 load 1028514-1.html
 load 1066089-1.html
+load 1074651-1.html
 load large_border_image_width.html
 load border-image-visited-link.html
--- a/xpcom/ds/TimeStamp_darwin.cpp
+++ b/xpcom/ds/TimeStamp_darwin.cpp
@ -103,7 +103,14 @@ int64_t
 BaseTimeDurationPlatformUtils::TicksFromMilliseconds(double aMilliseconds)
 {
  NS_ABORT_IF_FALSE(gInitialized, "calling TimeDuration too early");
-  return (aMilliseconds * kNsPerMsd) / sNsPerTick;
+  double result = (aMilliseconds * kNsPerMsd) / sNsPerTick;
+  if (result > INT64_MAX) {
+    return INT64_MAX;
+  } else if (result < INT64_MIN) {
+    return INT64_MIN;
+  }
+
+  return result;
 }

 int64_t
--- a/xpcom/ds/TimeStamp_posix.cpp
+++ b/xpcom/ds/TimeStamp_posix.cpp
@ -152,7 +152,14 @@ BaseTimeDurationPlatformUtils::ToSecondsSigDigits(int64_t aTicks)
 int64_t
 BaseTimeDurationPlatformUtils::TicksFromMilliseconds(double aMilliseconds)
 {
-  return aMilliseconds * kNsPerMsd;
+  double result = aMilliseconds * kNsPerMsd;
+  if (result > INT64_MAX) {
+    return INT64_MAX;
+  } else if (result < INT64_MIN) {
+    return INT64_MIN;
+  }
+
+  return result;
 }

 int64_t
--- a/xpcom/ds/TimeStamp_windows.cpp
+++ b/xpcom/ds/TimeStamp_windows.cpp
@ -434,7 +434,14 @@ BaseTimeDurationPlatformUtils::ToSecondsSigDigits(int64_t aTicks)
 int64_t
 BaseTimeDurationPlatformUtils::TicksFromMilliseconds(double aMilliseconds)
 {
-  return ms2mt(aMilliseconds);
+  double result = ms2mt(aMilliseconds);
+  if (result > INT64_MAX) {
+    return INT64_MAX;
+  } else if (result < INT64_MIN) {
+    return INT64_MIN;
+  }
+
+  return result;
 }

 int64_t