Bug 462968. Sanitize block height. r+sr=dbaron

layout/generic/nsBlockFrame.cpp

@@ -1425,6 +1425,9 @@ nsBlockFrame::ComputeFinalSize(const nsHTMLReflowState& aReflowState,
     NS_FRAME_SET_OVERFLOW_INCOMPLETE(aState.mReflowStatus);
   }
 
+  // Screen out negative heights --- can happen due to integer overflows :-(
+  aMetrics.height = PR_MAX(0, aMetrics.height);
+
 #ifdef DEBUG_blocks
   if (CRAZY_WIDTH(aMetrics.width) || CRAZY_HEIGHT(aMetrics.height)) {
     ListTag(stdout);