Clamp radial gradient end radii

third_party/WebKit/Source/core/css/CSSGradientValue.cpp

Index: third_party/WebKit/Source/core/css/CSSGradientValue.cpp
diff --git a/third_party/WebKit/Source/core/css/CSSGradientValue.cpp b/third_party/WebKit/Source/core/css/CSSGradientValue.cpp
index e1dc0c0b43687d82811e5cdc34aa0278e7b853fb..637d894c64eeafcbacf20b17a3cfe5d57a68fbd2 100644
--- a/third_party/WebKit/Source/core/css/CSSGradientValue.cpp
+++ b/third_party/WebKit/Source/core/css/CSSGradientValue.cpp
@@ -1033,10 +1033,10 @@ enum EndShapeType {
 FloatSize radiusToSide(const FloatPoint& point, const FloatSize& size, EndShapeType shape,
     bool (*compare)(float, float))
 {
-    float dx1 = fabs(point.x());
-    float dy1 = fabs(point.y());
-    float dx2 = fabs(point.x() - size.width());
-    float dy2 = fabs(point.y() - size.height());
+    float dx1 = clampTo<float>(fabs(point.x()));
+    float dy1 = clampTo<float>(fabs(point.y()));
+    float dx2 = clampTo<float>(fabs(point.x() - size.width()));
+    float dy2 = clampTo<float>(fabs(point.y() - size.height()));
 
     float dx = compare(dx1, dx2) ? dx1 : dx2;
     float dy = compare(dy1, dy2) ? dy1 : dy2;
@@ -1055,7 +1055,7 @@ inline FloatSize ellipseRadius(const FloatPoint& p, float aspectRatio)
     // x^2/a^2 + y^2/b^2 = 1
     // a/b = aspectRatio, b = a/aspectRatio
     // a = sqrt(x^2 + y^2/(1/r^2))
-    float a = sqrtf(p.x() * p.x() + p.y() * p.y() * aspectRatio * aspectRatio);
+    float a = clampTo<float>(sqrtf(p.x() * p.x() + p.y() * p.y() * aspectRatio * aspectRatio));

[fs, 2016/06/05 23:34:02]

Could the division on the next line potentially push this back over the edge
again? (p.x() = numeric_limits<float>::max(); aspectRatio < 1)

[f(malita), 2016/06/06 13:13:10]

Hrmpf, you're right.  Updated to clamp both values individually.

     return FloatSize(a, a / aspectRatio);
 }
 
@@ -1153,6 +1153,10 @@ PassRefPtr<Gradient> CSSRadialGradientValue::createGradient(const CSSToLengthCon
         }
     }
 
+    DCHECK(std::isfinite(firstRadius));
+    DCHECK(std::isfinite(secondRadius.width()));
+    DCHECK(std::isfinite(secondRadius.height()));
+
     bool isDegenerate = !secondRadius.width() || !secondRadius.height();
     RefPtr<Gradient> gradient = Gradient::create(firstPoint, firstRadius, secondPoint,
         isDegenerate ? 0 : secondRadius.width(), isDegenerate ? 1 : secondRadius.aspectRatio());