diff options
| author | Patrick Walton <pcwalton@mimiga.net> | 2015-08-18 18:41:55 -0700 |
|---|---|---|
| committer | Patrick Walton <pcwalton@mimiga.net> | 2015-08-18 18:44:50 -0700 |
| commit | 02b15e016d7adb89c9142e9e89a7048c15d9c085 (patch) | |
| tree | eb83a72f980ac3279d85fff7d1fc2153549b3d7a | |
| parent | 19d466b06250f10169e88fc7f0b447c7f2f8209e (diff) | |
| download | servo-02b15e016d7adb89c9142e9e89a7048c15d9c085.tar.gz servo-02b15e016d7adb89c9142e9e89a7048c15d9c085.zip | |
layout: Avoid a division by zero in `tile_image()`.
Fixes a crash on Facebook Timeline.
| -rw-r--r-- | components/layout/fragment.rs | 8 | ||||
| -rw-r--r-- | tests/ref/background_size_zero_a.html | 9 | ||||
| -rw-r--r-- | tests/ref/background_size_zero_ref.html | 3 | ||||
| -rw-r--r-- | tests/ref/basic.list | 1 |
4 files changed, 19 insertions, 2 deletions
diff --git a/components/layout/fragment.rs b/components/layout/fragment.rs index 568ebf50657..68dde96f3fb 100644 --- a/components/layout/fragment.rs +++ b/components/layout/fragment.rs @@ -390,9 +390,13 @@ impl ImageFragmentInfo { } /// Tile an image - pub fn tile_image(position: &mut Au, size: &mut Au, - virtual_position: Au, image_size: u32) { + pub fn tile_image(position: &mut Au, size: &mut Au, virtual_position: Au, image_size: u32) { + // Avoid division by zero below! let image_size = image_size as i32; + if image_size == 0 { + return + } + let delta_pixels = (virtual_position - *position).to_px(); let tile_count = (delta_pixels + image_size - 1) / image_size; let offset = Au::from_px(image_size * tile_count); diff --git a/tests/ref/background_size_zero_a.html b/tests/ref/background_size_zero_a.html new file mode 100644 index 00000000000..c059881513b --- /dev/null +++ b/tests/ref/background_size_zero_a.html @@ -0,0 +1,9 @@ +<!DOCTYPE html> +<style> +body { + background-image: url(400x400_green.png); + background-size: 0 0; +} +</style> +Don't crash! + diff --git a/tests/ref/background_size_zero_ref.html b/tests/ref/background_size_zero_ref.html new file mode 100644 index 00000000000..017aab9d2bc --- /dev/null +++ b/tests/ref/background_size_zero_ref.html @@ -0,0 +1,3 @@ +<!DOCTYPE html> +Don't crash! + diff --git a/tests/ref/basic.list b/tests/ref/basic.list index 5eba71f26b0..3d3ceeba10f 100644 --- a/tests/ref/basic.list +++ b/tests/ref/basic.list @@ -37,6 +37,7 @@ flaky_cpu == append_style_a.html append_style_b.html == background_repeat_y_a.html background_repeat_y_b.html == background_size_a.html background_size_ref.html == background_size_shorthand_a.html background_size_shorthand_ref.html +== background_size_zero_a.html background_size_zero_ref.html == background_style_attr.html background_ref.html == basic_width_px.html basic_width_em.html == block_formatting_context_a.html block_formatting_context_ref.html |