Handle very large transforms in ContainerNode::boundingBox

third_party/WebKit/Source/core/dom/ContainerNode.cpp

Index: third_party/WebKit/Source/core/dom/ContainerNode.cpp
diff --git a/third_party/WebKit/Source/core/dom/ContainerNode.cpp b/third_party/WebKit/Source/core/dom/ContainerNode.cpp
index b52be5b0b3322af298044d2fe96b8f5e68c0870f..8099f739da783e31233d97e0eb49a6183b592a90 100644
--- a/third_party/WebKit/Source/core/dom/ContainerNode.cpp
+++ b/third_party/WebKit/Source/core/dom/ContainerNode.cpp
@@ -952,7 +952,11 @@ LayoutRect ContainerNode::boundingBox() const
             upperLeft = lowerRight;
     }
 
-    return enclosingLayoutRect(FloatRect(upperLeft, lowerRight.expandedTo(upperLeft) - upperLeft));
+    FloatSize size = lowerRight.expandedTo(upperLeft) - upperLeft;
+    if (std::isnan(size.width()) || std::isnan(size.height()))
+        return LayoutRect();
+
+    return enclosingLayoutRect(FloatRect(upperLeft, size));
 }
 
 // This is used by FrameSelection to denote when the active-state of the page has changed