Check for infinite value in txFormatNumberFunctionCall.

1 files changed, 6 insertions, 0 deletions

diff --git a/dom/xslt/xslt/txFormatNumberFunctionCall.cpp b/dom/xslt/xslt/txFormatNumberFunctionCall.cpp
index c41b81ab1..e51ac3f25 100644
--- a/dom/xslt/xslt/txFormatNumberFunctionCall.cpp
+++ b/dom/xslt/xslt/txFormatNumberFunctionCall.cpp
@@ -265,6 +265,12 @@ txFormatNumberFunctionCall::evaluate(txIEvalContext* aContext,
 
     value = fabs(value) * multiplier;
 
+    // Make sure the multiplier didn't push value to infinity.
+    if (value == mozilla::PositiveInfinity<double>()) {
+        return aContext->recycler()->getStringResult(format->mInfinity,
+                                                     aResult);
+    }
+
     // Prefix
     nsAutoString res(prefix);