diff --git a/layout/generic/nsBlockFrame.cpp b/layout/generic/nsBlockFrame.cpp index 170d9118e4f..8e708d62926 100644 --- a/layout/generic/nsBlockFrame.cpp +++ b/layout/generic/nsBlockFrame.cpp @@ -1425,6 +1425,9 @@ nsBlockFrame::ComputeFinalSize(const nsHTMLReflowState& aReflowState, NS_FRAME_SET_OVERFLOW_INCOMPLETE(aState.mReflowStatus); } + // Screen out negative heights --- can happen due to integer overflows :-( + aMetrics.height = PR_MAX(0, aMetrics.height); + #ifdef DEBUG_blocks if (CRAZY_WIDTH(aMetrics.width) || CRAZY_HEIGHT(aMetrics.height)) { ListTag(stdout);