Index: third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp |
diff --git a/third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp b/third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp |
index 354b483ef52385ddbad04dfb8523aac5b67b97c0..1bb13ac6abfcce448c0137216444ebb5ffb74e89 100644 |
--- a/third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp |
+++ b/third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp |
@@ -87,7 +87,10 @@ static inline bool parseSimpleLength(const CharacterType* characters, unsigned l |
// not represent a double. |
bool ok; |
number = charactersToDouble(characters, length, &ok); |
- return ok && CSSParserToken::isValidNumericValue(number); |
+ if (!ok) |
+ return false; |
+ number = clampTo<double>(number, -std::numeric_limits<float>::max(), std::numeric_limits<float>::max()); |
+ return true; |
} |
static CSSValue* parseSimpleLengthValue(CSSPropertyID propertyId, const String& string, CSSParserMode cssParserMode) |