Handle very large transforms in ContainerNode::boundingBox

third_party/WebKit/Source/core/dom/ContainerNode.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2013 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 934 matching lines @@
 
     // If we've found one corner, but not the other,
     // then we should just return a point at the corner that we did find.
     if (foundUpperLeft != foundLowerRight) {
         if (foundUpperLeft)
             lowerRight = upperLeft;
         else
             upperLeft = lowerRight;
     }
 
-    return enclosingLayoutRect(FloatRect(upperLeft, lowerRight.expandedTo(upperLeft) - upperLeft));
+    FloatSize size = lowerRight.expandedTo(upperLeft) - upperLeft;
+    if (std::isnan(size.width()) || std::isnan(size.height()))
+        return LayoutRect();
+
+    return enclosingLayoutRect(FloatRect(upperLeft, size));
 }
 
 // This is used by FrameSelection to denote when the active-state of the page has changed
 // independent of the focused element changing.
 void ContainerNode::focusStateChanged()
 {
     // If we're just changing the window's active state and the focused node has no
     // layoutObject we can just ignore the state change.
     if (!layoutObject())
         return;
@@ skipping 408 matching lines @@
         return true;
 
     if (node->isElementNode() && toElement(node)->shadow())
         return true;
 
     return false;
 }
 #endif
 
 } // namespace blink