commit 3ee00d15b8329fcbe86f9c04edfac77d4d98e96f
parent 4b0a188f44b5ac5652bedd10216ec9acb4cd2215
Author: Eri Pazos Pérez <eri@igalia.com>
Date: Tue, 14 Oct 2025 10:54:19 +0000
Bug 1993534 - Fix IsLengthUnit range r=fredw,emilio,firefox-style-system-reviewers
Differential Revision: https://phabricator.services.mozilla.com/D268250
Diffstat:
2 files changed, 26 insertions(+), 1 deletion(-)
diff --git a/layout/style/nsCSSValue.h b/layout/style/nsCSSValue.h
@@ -58,6 +58,8 @@ enum nsCSSUnit : uint32_t {
eCSSUnit_VH = 951,
eCSSUnit_VMin = 952,
eCSSUnit_VMax = 953,
+
+ eCSSUnit_LastLength = eCSSUnit_VMax,
};
struct nsCSSValuePair;
@@ -86,7 +88,7 @@ class nsCSSValue {
nsCSSUnit GetUnit() const { return mUnit; }
bool IsLengthUnit() const {
- return eCSSUnit_EM <= mUnit && mUnit <= eCSSUnit_Pixel;
+ return eCSSUnit_EM <= mUnit && mUnit <= eCSSUnit_LastLength;
}
/**
* A "pixel" length unit is a some multiple of CSS pixels.
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1993534-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1993534-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1993534">
+<math>
+ <mtext mathsize="1cap">A</mtext>
+ <mtext mathsize="1ch">A</mtext>
+ <mtext mathsize="1cm">A</mtext>
+ <mtext mathsize="1em">A</mtext>
+ <mtext mathsize="1ex">A</mtext>
+ <mtext mathsize="1ic">A</mtext>
+ <mtext mathsize="1in">A</mtext>
+ <mtext mathsize="1lh">A</mtext>
+ <mtext mathsize="1mm">A</mtext>
+ <mtext mathsize="1pc">A</mtext>
+ <mtext mathsize="1pt">A</mtext>
+ <mtext mathsize="1px">A</mtext>
+ <mtext mathsize="1q">A</mtext>
+ <mtext mathsize="1rem">A</mtext>
+ <mtext mathsize="1rlh">A</mtext>
+ <mtext mathsize="1vh">A</mtext>
+ <mtext mathsize="1vmax">A</mtext>
+ <mtext mathsize="1vmin">A</mtext>
+ <mtext mathsize="1vw">A</mtext>
+</math>
