Improve numeric value handling in CSS Parser

third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSParserFastPaths.h"
 
 #include "core/StylePropertyShorthand.h"
 #include "core/css/CSSColorValue.h"
 #include "core/css/CSSFunctionValue.h"
 #include "core/css/CSSInheritedValue.h"
@@ skipping 69 matching lines @@
     } else if (length > 1 && characters[length - 1] == '%') {
         length -= 1;
         unit = CSSPrimitiveValue::UnitType::Percentage;
     }
 
     // We rely on charactersToDouble for validation as well. The function
     // will set "ok" to "false" if the entire passed-in character range does
     // not represent a double.
     bool ok;
     number = charactersToDouble(characters, length, &ok);
-    return ok && CSSParserToken::isValidNumericValue(number);
+    if (!ok)
+        return false;
+    number = clampTo<double>(number, -std::numeric_limits<float>::max(), std::numeric_limits<float>::max());
+    return true;
 }
 
 static CSSValue* parseSimpleLengthValue(CSSPropertyID propertyId, const String& string, CSSParserMode cssParserMode)
 {
     ASSERT(!string.isEmpty());
     bool acceptsNegativeNumbers = false;
 
     // In @viewport, width and height are shorthands, not simple length values.
     if (isCSSViewportParsingEnabledForMode(cssParserMode) || !isSimpleLengthPropertyID(propertyId, acceptsNegativeNumbers))
         return nullptr;
@@ skipping 977 matching lines @@
     if (isColorPropertyID(propertyID))
         return parseColor(string, parserMode);
     if (CSSValue* keyword = parseKeywordValue(propertyID, string, parserMode))
         return keyword;
     if (CSSValue* transform = parseSimpleTransform(propertyID, string))
         return transform;
     return nullptr;
 }
 
 } // namespace blink