From a103f2051b1cdfd148c100fd24633ccc197c84c5 Mon Sep 17 00:00:00 2001
From: Pale Moon <git-repo@palemoon.org>
Date: Tue, 15 May 2018 16:56:57 +0200
Subject: Check for infinite value in txFormatNumberFunctionCall.

---
 dom/xslt/xslt/txFormatNumberFunctionCall.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/dom/xslt/xslt/txFormatNumberFunctionCall.cpp b/dom/xslt/xslt/txFormatNumberFunctionCall.cpp
index c41b81ab1..e51ac3f25 100644
--- a/dom/xslt/xslt/txFormatNumberFunctionCall.cpp
+++ b/dom/xslt/xslt/txFormatNumberFunctionCall.cpp
@@ -265,6 +265,12 @@ txFormatNumberFunctionCall::evaluate(txIEvalContext* aContext,
 
     value = fabs(value) * multiplier;
 
+    // Make sure the multiplier didn't push value to infinity.
+    if (value == mozilla::PositiveInfinity<double>()) {
+        return aContext->recycler()->getStringResult(format->mInfinity,
+                                                     aResult);
+    }
+
     // Prefix
     nsAutoString res(prefix);
 
-- 
cgit v1.2.3