Clamp CSS numbers to float range at parsing.

third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSParserFastPaths.h"
 
 #include "core/StylePropertyShorthand.h"
 #include "core/css/CSSFunctionValue.h"
 #include "core/css/CSSValuePool.h"
 #include "core/css/parser/CSSParserIdioms.h"
@@ skipping 65 matching lines @@
     } else if (length > 1 && characters[length - 1] == '%') {
         length -= 1;
         unit = CSSPrimitiveValue::UnitType::Percentage;
     }
 
     // We rely on charactersToDouble for validation as well. The function
     // will set "ok" to "false" if the entire passed-in character range does
     // not represent a double.
     bool ok;
     number = charactersToDouble(characters, length, &ok);
-    return ok && CSSPropertyParser::isValidNumericValue(number);
+    if (!std::isfinite(number)) {

[rune, 2016/04/25 12:24:29]

Should this be std::isnan instead?

+        ok = false;
+    } else {
+        number = clampTo<float>(number);
+    }
+    return ok;
 }
 
 static CSSValue* parseSimpleLengthValue(CSSPropertyID propertyId, const String& string, CSSParserMode cssParserMode)
 {
     ASSERT(!string.isEmpty());
     bool acceptsNegativeNumbers = false;
 
     // In @viewport, width and height are shorthands, not simple length values.
     if (isCSSViewportParsingEnabledForMode(cssParserMode) || !isSimpleLengthPropertyID(propertyId, acceptsNegativeNumbers))
         return nullptr;
@@ skipping 931 matching lines @@
     if (isColorPropertyID(propertyID))
         return parseColor(string, parserMode);
     if (CSSValue* keyword = parseKeywordValue(propertyID, string, parserMode))
         return keyword;
     if (CSSValue* transform = parseSimpleTransform(propertyID, string))
         return transform;
     return nullptr;
 }
 
 } // namespace blink