Fixed crash with zero/infinite aspect ratio radial gradients

third_party/WebKit/Source/core/css/CSSGradientValue.cpp

 /*
  * Copyright (C) 2008 Apple Inc.  All rights reserved.
  * Copyright (C) 2015 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 1035 matching lines @@
         return compare(dx, dy) ? FloatSize(dx, dx) : FloatSize(dy, dy);
 
     ASSERT(shape == EllipseEndShape);
     return FloatSize(dx, dy);
 }
 
 // Compute the radius of an ellipse with center at 0,0 which passes through p, and has
 // width/height given by aspectRatio.
 inline FloatSize ellipseRadius(const FloatPoint& p, float aspectRatio)
 {
+    // If the aspectRatio is 0 or infinite, the ellipse is completely flat.
+    // TODO(sashab): Implement Degenerate Radial Gradients, see crbug.com/635727.
+    if (aspectRatio == 0 || std::isinf(aspectRatio))
+        return FloatSize(0, 0);
+
     // x^2/a^2 + y^2/b^2 = 1
     // a/b = aspectRatio, b = a/aspectRatio
     // a = sqrt(x^2 + y^2/(1/r^2))
     float a = sqrtf(p.x() * p.x() + p.y() * p.y() * aspectRatio * aspectRatio);
     return FloatSize(clampTo<float>(a), clampTo<float>(a / aspectRatio));
 }
 
 // Compute the radius to the closest/farthest corner (depending on the compare functor).
 FloatSize radiusToCorner(const FloatPoint& point, const FloatSize& size, EndShapeType shape,
     bool (*compare)(float, float))
@@ skipping 156 matching lines @@
     visitor->trace(m_firstRadius);
     visitor->trace(m_secondRadius);
     visitor->trace(m_shape);
     visitor->trace(m_sizingBehavior);
     visitor->trace(m_endHorizontalSize);
     visitor->trace(m_endVerticalSize);
     CSSGradientValue::traceAfterDispatch(visitor);
 }
 
 } // namespace blink