2 files changed, 17 insertions, 3 deletions
diff --git a/components/script/dom/htmlformelement.rs b/components/script/dom/htmlformelement.rs
index a4cb42711d7..8759fbafe5e 100644
--- a/components/script/dom/htmlformelement.rs
+++ b/components/script/dom/htmlformelement.rs
@@ -203,7 +203,8 @@ impl HTMLFormElementMethods for HTMLFormElement {
                                 elem.downcast::<HTMLTextAreaElement>().unwrap().form_owner()
                             }
                             _ => {
-                                debug_assert!(!elem.downcast::<HTMLElement>().unwrap().is_listed_element());
+                                debug_assert!(!elem.downcast::<HTMLElement>().unwrap().is_listed_element() ||
+                                              elem.local_name() == &atom!("keygen"));
                                 return false;
                             }
                         }
diff --git a/components/script/dom/htmlimageelement.rs b/components/script/dom/htmlimageelement.rs
index 24e28e7639b..c6652913c42 100644
--- a/components/script/dom/htmlimageelement.rs
+++ b/components/script/dom/htmlimageelement.rs
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-use app_units::Au;
+use app_units::{Au, AU_PER_PX};
 use dom::attr::Attr;
 use dom::bindings::cell::DOMRefCell;
 use dom::bindings::codegen::Bindings::HTMLImageElementBinding;
@@ -28,6 +28,7 @@ use net_traits::image_cache_thread::{ImageResponder, ImageResponse};
 use script_runtime::CommonScriptMsg;
 use script_runtime::ScriptThreadEventCategory::UpdateReplacedElement;
 use script_thread::Runnable;
+use std::i32;
 use std::sync::Arc;
 use string_cache::Atom;
 use style::attr::{AttrValue, LengthOrPercentageOrAuto};
@@ -443,7 +444,19 @@ fn image_dimension_setter(element: &Element, attr: Atom, value: u32) {
     } else {
         value
     };
-    let dim = LengthOrPercentageOrAuto::Length(Au::from_px(value as i32));
+
+    // FIXME: There are probably quite a few more cases of this. This is the
+    // only overflow that was hitting on automation, but we should consider what
+    // to do in the general case case.
+    //
+    // See <https://github.com/servo/app_units/issues/22>
+    let pixel_value = if value > (i32::MAX / AU_PER_PX) as u32 {
+        0
+    } else {
+        value
+    };
+
+    let dim = LengthOrPercentageOrAuto::Length(Au::from_px(pixel_value as i32));
     let value = AttrValue::Dimension(value.to_string(), dim);
     element.set_attribute(&attr, value);
 }