IntersectionObserver: check threshold parameters for NaN.

third_party/WebKit/Source/core/dom/IntersectionObserver.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/dom/IntersectionObserver.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "core/css/parser/CSSParserTokenRange.h"
 #include "core/css/parser/CSSTokenizer.h"
 #include "core/dom/Element.h"
@@ skipping 94 matching lines @@
 void parseThresholds(const DoubleOrDoubleArray& thresholdParameter, Vector<float>& thresholds, ExceptionState& exceptionState)
 {
     if (thresholdParameter.isDouble()) {
         thresholds.append(static_cast<float>(thresholdParameter.getAsDouble()));
     } else {
         for (auto thresholdValue : thresholdParameter.getAsDoubleArray())
             thresholds.append(static_cast<float>(thresholdValue));
     }
 
     for (auto thresholdValue : thresholds) {
-        if (thresholdValue < 0.0 || thresholdValue > 1.0) {
-            exceptionState.throwRangeError("Threshold values must be between 0 and 1");
+        if (std::isnan(thresholdValue) || thresholdValue < 0.0 || thresholdValue > 1.0) {
+            exceptionState.throwRangeError("Threshold values must be numbers between 0 and 1");
             break;
         }
     }
 
     std::sort(thresholds.begin(), thresholds.end());
 }
 
 // Returns the root Node of a given Document to use as the IntersectionObserver
 // root when no root is given.
 // TODO(szager): it doesn't support RemoteFrames, see https://crbug.com/615156
@@ skipping 278 matching lines @@
 
 DEFINE_TRACE(IntersectionObserver)
 {
     visitor->template registerWeakMembers<IntersectionObserver, &IntersectionObserver::clearWeakMembers>(this);
     visitor->trace(m_callback);
     visitor->trace(m_observations);
     visitor->trace(m_entries);
 }
 
 } // namespace blink