Clamp CSS numbers to float range at parsing.

third_party/WebKit/Source/core/css/parser/CSSParserToken.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSParserToken.h"
 
 #include "core/css/CSSMarkup.h"
 #include "core/css/parser/CSSPropertyParser.h"
 #include "wtf/HashMap.h"
 #include "wtf/text/StringBuilder.h"
@@ skipping 23 matching lines @@
     initValueFromCSSParserString(value);
     m_id = -1;
 }
 
 CSSParserToken::CSSParserToken(CSSParserTokenType type, double numericValue, NumericValueType numericValueType, NumericSign sign)
     : m_type(type)
     , m_blockType(NotBlock)
     , m_numericValueType(numericValueType)
     , m_numericSign(sign)
     , m_unit(static_cast<unsigned>(CSSPrimitiveValue::UnitType::Number))
-    , m_numericValue(numericValue)
 {
+    if (!std::isfinite(numericValue)) {
+        m_numericValue = 0.0;

[rune, 2016/04/25 12:24:29]

Shouldn't +/-inf be clamped too?

Why is 0 a good choice here?

+    } else {
+        m_numericValue = clampTo<float>(numericValue);
+    }
     ASSERT(type == NumberToken);
 }
 
 CSSParserToken::CSSParserToken(CSSParserTokenType type, UChar32 start, UChar32 end)
     : m_type(UnicodeRangeToken)
     , m_blockType(NotBlock)
 {
     ASSERT_UNUSED(type, type == UnicodeRangeToken);
     m_unicodeRange.start = start;
     m_unicodeRange.end = end;
@@ skipping 178 matching lines @@
         return builder.append('}');
 
     case EOFToken:
     case CommentToken:
         ASSERT_NOT_REACHED();
         return;
     }
 }
 
 } // namespace blink