To reproduce: - Go to about:config - Set layout.css.dpi to 30000 Result -> crash Talkback ID: TB29372009E nsStyleBorder::SetBorderStyle [mozilla\dist\include\layout\nsstylestruct.h, line 419] nsRuleNode::WalkRuleTree [mozilla\layout\style\nsstylestructlist.h, line 136] nsRuleNode::GetBorderData [mozilla\layout\style\nsrulenode.cpp, line 1193] nsRuleNode::GetStyleBorder [mozilla\layout\style\nsstylestructlist.h, line 134] nsStyleContext::GetStyleBorder [mozilla\layout\style\nsstylestructlist.h, line 134] nsIFrame::GetBorderAndPadding [mozilla\layout\xul\base\src\nsbox.cpp, line 345] nsFrame::RefreshSizeCache [mozilla\layout\generic\nsframe.cpp, line 5807] nsFrame::GetBoxAscent [mozilla\layout\generic\nsframe.cpp, line 5982] nsBoxFrame::GetBoxAscent [mozilla\layout\xul\base\src\nsboxframe.cpp, line 869] nsBoxFrame::GetBoxAscent [mozilla\layout\xul\base\src\nsboxframe.cpp, line 869] nsBoxFrame::GetBoxAscent [mozilla\layout\xul\base\src\nsboxframe.cpp, line 869] nsBoxFrame::GetBoxAscent [mozilla\layout\xul\base\src\nsboxframe.cpp, line 869] nsBoxFrame::GetBoxAscent [mozilla\layout\xul\base\src\nsboxframe.cpp, line 869] This regressed when the fix for bug 177805 went in. Maybe there should be a maximum allowed value or something?

There's an easy fix for the crash; I'll post it in a moment. That said, how far do we want to go to protect the user? Even if we don't crash, if someone sets their dpi to 3000, it'll be nearly impossible to set it back without manually editing prefs.js.

Comment on attachment 255284 [details] [diff] [review] Patch We don't need to protect users who are whacking prefs via about:config. If we introduce real UI for manipulating DPI, then we need to protect the user there.