From 1a37e69ce9096716bfc3e193e99a6eeb0c34b7c8 Mon Sep 17 00:00:00 2001
From: Hiroyuki Ikezoe <hikezoe@mozilla.com>
Date: Wed, 26 Apr 2017 19:20:12 +0900
Subject: [PATCH] Fix overflow in ::nth-child()

---
 components/selectors/matching.rs | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/components/selectors/matching.rs b/components/selectors/matching.rs
index 24e3345d294..ada15089061 100644
--- a/components/selectors/matching.rs
+++ b/components/selectors/matching.rs
@@ -407,7 +407,7 @@ fn matches_generic_nth_child<E, F>(element: &E,
         HAS_SLOW_SELECTOR_LATER_SIBLINGS
     });
 
-    let mut index = 1;
+    let mut index: i32 = 1;
     let mut next_sibling = if is_from_end {
         element.next_sibling_element()
     } else {
@@ -435,11 +435,13 @@ fn matches_generic_nth_child<E, F>(element: &E,
         };
     }
 
-    if a == 0 {
-        b == index
-    } else {
-        (index - b) / a >= 0 &&
-        (index - b) % a == 0
+    // Is there a non-negative integer n such that An+B=index?
+    match index.checked_sub(b) {
+        None => false,
+        Some(an) => match an.checked_div(a) {
+            Some(n) => n >= 0 && a * n == an,
+            None /* a == 0 */ => an == 0,
+        },
     }
 }