Handle huge values for cols/rows in frameset

Source/core/html/HTMLDimension.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 39 matching lines @@
     if (lastParsedIndex >= endOfCurrentToken)
         return HTMLDimension(value, HTMLDimension::Relative);
 
     size_t position = lastParsedIndex;
     while (position < endOfCurrentToken && isASCIIDigit(characters[position]))
         ++position;
 
     if (position > lastParsedIndex) {
         bool ok = false;
         unsigned integerValue = charactersToUIntStrict(characters + lastParsedIndex, position - lastParsedIndex, &ok);
-        ASSERT(ok);
+        if (!ok)
+            return HTMLDimension(0., HTMLDimension::Relative);
         value += integerValue;
 
         if (position < endOfCurrentToken && characters[position] == '.') {
             ++position;
             Vector<CharacterType> fractionNumbers;
             while (position < endOfCurrentToken && (isASCIIDigit(characters[position]) || isASCIISpace(characters[position]))) {
                 if (isASCIIDigit(characters[position]))
                     fractionNumbers.append(characters[position]);
                 ++position;
             }
 
             if (fractionNumbers.size()) {
                 double fractionValue = charactersToUIntStrict(fractionNumbers.data(), fractionNumbers.size(), &ok);
-                ASSERT(ok);
+                if (!ok)
+                    return HTMLDimension(0., HTMLDimension::Relative);
 
                 value += fractionValue / pow(10., static_cast<double>(fractionNumbers.size()));
             }
         }
     }
 
     while (position < endOfCurrentToken && isASCIISpace(characters[position]))
         ++position;
 
     if (position < endOfCurrentToken) {
@@ skipping 39 matching lines @@
 
         parsedDimensions.append(parseDimension(trimmedString, lastParsedIndex, nextComma));
         lastParsedIndex = nextComma + 1;
     }
 
     parsedDimensions.append(parseDimension(trimmedString, lastParsedIndex, trimmedString.length()));
     return parsedDimensions;
 }
 
 } // namespace blink