tor-browser

commit bf4ac99b53152bbbc79226f3f7285ca79eebfbe1
parent 34b3ec76860f1fb94839a0f84856f9253b33b60b
Author: longsonr <longsonr@gmail.com>
Date:   Tue, 28 Oct 2025 13:38:35 +0000

Bug 1996058 - Fix crash when clipRect has a negative width or height r=emilio

Differential Revision: https://phabricator.services.mozilla.com/D269892

Diffstat:
M
layout/svg/SVGUtils.cpp
 | 
4
++--
A
testing/web-platform/tests/css/CSS2/visufx/crashtests/firefox-bug-1996058.html
 | 
2
++

2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/layout/svg/SVGUtils.cpp b/layout/svg/SVGUtils.cpp
@@ -804,10 +804,10 @@ gfxRect SVGUtils::GetClipRectForFrame(const nsIFrame* aFrame, float aX,
   gfxRect clipRect =
       gfxRect(clipPxRect.x, clipPxRect.y, clipPxRect.width, clipPxRect.height);
   if (rect.right.IsAuto()) {
-    clipRect.width = aWidth - clipRect.X();
+    clipRect.width = std::max(aWidth - clipRect.X(), 0.0);
   }
   if (rect.bottom.IsAuto()) {
-    clipRect.height = aHeight - clipRect.Y();
+    clipRect.height = std::max(aHeight - clipRect.Y(), 0.0);
   }
   if (disp->mOverflowX != StyleOverflow::Hidden) {
     clipRect.x = aX;
diff --git a/testing/web-platform/tests/css/CSS2/visufx/crashtests/firefox-bug-1996058.html b/testing/web-platform/tests/css/CSS2/visufx/crashtests/firefox-bug-1996058.html
@@ -0,0 +1,2 @@
+<svg>
+<image clip="rect(0.70em,auto,0em,886px)" href="data:image/gif;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs=">