Bug 1358754 - Fix overflow in ::nth-child(). r?bholley draft
authorHiroyuki Ikezoe <hikezoe@mozilla.com>
Sat, 22 Apr 2017 19:40:14 +0900
changeset 566739 bf3d2404024da8ecb2432e2a5135e90e7b3647f0
parent 566738 c804187fc48a533995204f71bfc62b0a8698844e
child 625401 4740043f026f054c9a94dbc49e9dc56418f0b6ee
push id55309
push userhikezoe@mozilla.com
push dateSat, 22 Apr 2017 10:40:41 +0000
reviewersbholley
bugs1358754
milestone55.0a1
Bug 1358754 - Fix overflow in ::nth-child(). r?bholley MozReview-Commit-ID: CZ9ZR3j8hQt
servo/components/selectors/matching.rs
--- a/servo/components/selectors/matching.rs
+++ b/servo/components/selectors/matching.rs
@@ -475,18 +475,23 @@ fn matches_generic_nth_child<E, F>(eleme
         } else {
             sibling.prev_sibling_element()
         };
     }
 
     if a == 0 {
         b == index
     } else {
-        (index - b) / a >= 0 &&
-        (index - b) % a == 0
+        match index.checked_sub(b) {
+            None => false,
+            Some(r) => {
+                r.checked_div(a).map_or(false, |r| r >= 0) &&
+                r.checked_rem(a).map_or(false, |r| r == 0)
+            },
+        }
     }
 }
 
 #[inline]
 fn matches_first_child<E, F>(element: &E, flags_setter: &mut F) -> bool
     where E: Element,
           F: FnMut(&E, ElementSelectorFlags),
 {