Bug 2070015 - Fix an off-by-one in double-conversion's ToFixed DBL_MAX digit count. r=sergesanspaille

DBL_MAX has 309 integer digits, not 308, so ToFixed(DBL_MAX, 100) overflows the stack buffer our
to-fixed-dbl-max.patch sizes from kMaxFixedDigitsBeforePoint. Reachable via mozilla::Smprintf.

Differential Revision: https://phabricator.services.mozilla.com/D324152

mfbt/double-conversion/double-conversion/double-to-string.h

@@ -38,7 +38,7 @@ class DoubleToStringConverter {
   // When calling ToFixed with a double > 10^kMaxFixedDigitsBeforePoint
   // or a requested_digits parameter > kMaxFixedDigitsAfterPoint then the
   // function returns false.
-  static const int kMaxFixedDigitsBeforePoint = 308;
+  static const int kMaxFixedDigitsBeforePoint = 309;
   static const int kMaxFixedDigitsAfterPoint = 100;
 
   // When calling ToExponential with a requested_digits

mfbt/double-conversion/to-fixed-dbl-max.patch

@@ -26,7 +26,7 @@ diff --git a/double-conversion/double-to-string.h b/double-conversion/double-to-
    // or a requested_digits parameter > kMaxFixedDigitsAfterPoint then the
    // function returns false.
 -  static const int kMaxFixedDigitsBeforePoint = 60;
-+  static const int kMaxFixedDigitsBeforePoint = 308;
++  static const int kMaxFixedDigitsBeforePoint = 309;
    static const int kMaxFixedDigitsAfterPoint = 100;
  
    // When calling ToExponential with a requested_digits

mozglue/tests/TestPrintf.cpp

@@ -264,5 +264,11 @@ int main()
   // and the negative sign.
   MOZ_RELEASE_ASSERT(strlen(dbl_max.get()) == 317);
 
+  // Avoid a stack buffer overflow when formatting DBL_MAX with the maximum
+  // precision.
+  mozilla::SmprintfPointer dbl_max_100 = mozilla::Smprintf("%.100f", DBL_MAX);
+  MOZ_RELEASE_ASSERT(dbl_max_100);
+  MOZ_RELEASE_ASSERT(strlen(dbl_max_100.get()) == 410);
+
   return 0;
 }