Clamp CSS numbers to float range at parsing.

third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp

Index: third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp
diff --git a/third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp b/third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp
index 7c51b2eaef72e96480789f22032b1d8ea4b03576..d88aa31cac1b86757677a59777c20023110c4a6a 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp
@@ -83,7 +83,12 @@ static inline bool parseSimpleLength(const CharacterType* characters, unsigned l
     // not represent a double.
     bool ok;
     number = charactersToDouble(characters, length, &ok);
-    return ok && CSSPropertyParser::isValidNumericValue(number);
+    if (!std::isfinite(number)) {

[rune, 2016/04/25 12:24:29]

Should this be std::isnan instead?

+        ok = false;
+    } else {
+        number = clampTo<float>(number);
+    }
+    return ok;
 }
 
 static CSSValue* parseSimpleLengthValue(CSSPropertyID propertyId, const String& string, CSSParserMode cssParserMode)