Clamp radial gradient end radii

third_party/WebKit/Source/core/css/CSSGradientValue.cpp

 /*
  * Copyright (C) 2008 Apple Inc.  All rights reserved.
  * Copyright (C) 2015 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 1015 matching lines @@
 
 enum EndShapeType {
     CircleEndShape,
     EllipseEndShape
 };
 
 // Compute the radius to the closest/farthest side (depending on the compare functor).
 FloatSize radiusToSide(const FloatPoint& point, const FloatSize& size, EndShapeType shape,
     bool (*compare)(float, float))
 {
-    float dx1 = fabs(point.x());
-    float dy1 = fabs(point.y());
-    float dx2 = fabs(point.x() - size.width());
-    float dy2 = fabs(point.y() - size.height());
+    float dx1 = clampTo<float>(fabs(point.x()));
+    float dy1 = clampTo<float>(fabs(point.y()));
+    float dx2 = clampTo<float>(fabs(point.x() - size.width()));
+    float dy2 = clampTo<float>(fabs(point.y() - size.height()));
 
     float dx = compare(dx1, dx2) ? dx1 : dx2;
     float dy = compare(dy1, dy2) ? dy1 : dy2;
 
     if (shape == CircleEndShape)
         return compare(dx, dy) ? FloatSize(dx, dx) : FloatSize(dy, dy);
 
     ASSERT(shape == EllipseEndShape);
     return FloatSize(dx, dy);
 }
 
 // Compute the radius of an ellipse with center at 0,0 which passes through p, and has
 // width/height given by aspectRatio.
 inline FloatSize ellipseRadius(const FloatPoint& p, float aspectRatio)
 {
     // x^2/a^2 + y^2/b^2 = 1
     // a/b = aspectRatio, b = a/aspectRatio
     // a = sqrt(x^2 + y^2/(1/r^2))
-    float a = sqrtf(p.x() * p.x() + p.y() * p.y() * aspectRatio * aspectRatio);
+    float a = clampTo<float>(sqrtf(p.x() * p.x() + p.y() * p.y() * aspectRatio * aspectRatio));

[fs, 2016/06/05 23:34:02]

Could the division on the next line potentially push this back over the edge
again? (p.x() = numeric_limits<float>::max(); aspectRatio < 1)

[f(malita), 2016/06/06 13:13:10]

Hrmpf, you're right.  Updated to clamp both values individually.

     return FloatSize(a, a / aspectRatio);
 }
 
 // Compute the radius to the closest/farthest corner (depending on the compare functor).
 FloatSize radiusToCorner(const FloatPoint& point, const FloatSize& size, EndShapeType shape,
     bool (*compare)(float, float))
 {
     const FloatRect rect(FloatPoint(), size);
     const FloatPoint corners[] = {
         rect.minXMinYCorner(),
@@ skipping 77 matching lines @@
             secondRadius = radiusToCorner(secondPoint, floatSize, shape,
                 [] (float a, float b) { return a < b; });
             break;
         default:
             secondRadius = radiusToCorner(secondPoint, floatSize, shape,
                 [] (float a, float b) { return a > b; });
             break;
         }
     }
 
+    DCHECK(std::isfinite(firstRadius));
+    DCHECK(std::isfinite(secondRadius.width()));
+    DCHECK(std::isfinite(secondRadius.height()));
+
     bool isDegenerate = !secondRadius.width() || !secondRadius.height();
     RefPtr<Gradient> gradient = Gradient::create(firstPoint, firstRadius, secondPoint,
         isDegenerate ? 0 : secondRadius.width(), isDegenerate ? 1 : secondRadius.aspectRatio());
 
     gradient->setSpreadMethod(m_repeating ? SpreadMethodRepeat : SpreadMethodPad);
     gradient->setDrawsInPMColorSpace(true);
 
     // Now add the stops.
     addStops(gradient.get(), conversionData, object);
 
@@ skipping 51 matching lines @@
     visitor->trace(m_firstRadius);
     visitor->trace(m_secondRadius);
     visitor->trace(m_shape);
     visitor->trace(m_sizingBehavior);
     visitor->trace(m_endHorizontalSize);
     visitor->trace(m_endVerticalSize);
     CSSGradientValue::traceAfterDispatch(visitor);
 }
 
 } // namespace blink