[css-grid] Fix crash clamping grid lines

third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSPropertyParser.h"
 
 #include "core/StylePropertyShorthand.h"
 #include "core/css/CSSBasicShapeValues.h"
 #include "core/css/CSSBorderImage.h"
 #include "core/css/CSSContentDistributionValue.h"
@@ skipping 3003 matching lines @@
   }
 
   if (spanValue && !numericValue && !gridLineName)
     return nullptr;  // "span" keyword alone is invalid.
   if (spanValue && numericValue && numericValue->getIntValue() < 0)
     return nullptr;  // Negative numbers are not allowed for span.
   if (numericValue && numericValue->getIntValue() == 0)
     return nullptr;  // An <integer> value of zero makes the declaration
                      // invalid.
 
+  if (numericValue) {

[jfernandez, 2016/12/02 12:28:03]

Wouldn't be better to define new CSSPrimitiveValue APIs ? Something like  
  - getIntValue(min, max)
  - clampIntValue(min, max)

[Manuel Rego, 2016/12/15 16:51:22]

Uploaded new version following this approach.

+    if (numericValue->getIntValue() > kGridMaxTracks) {
+      numericValue = CSSPrimitiveValue::create(
+          kGridMaxTracks, CSSPrimitiveValue::UnitType::Integer);
+    } else if (numericValue->getIntValue() < -kGridMaxTracks) {
+      numericValue = CSSPrimitiveValue::create(
+          -kGridMaxTracks, CSSPrimitiveValue::UnitType::Integer);
+    }
+  }
+
   CSSValueList* values = CSSValueList::createSpaceSeparated();
   if (spanValue)
     values->append(*spanValue);
   if (numericValue)
     values->append(*numericValue);
   if (gridLineName)
     values->append(*gridLineName);
   ASSERT(values->length());
   return values;
 }
@@ skipping 2294 matching lines @@
     case CSSPropertyGridTemplate:
       return consumeGridTemplateShorthand(CSSPropertyGridTemplate, important);
     case CSSPropertyGrid:
       return consumeGridShorthand(important);
     default:
       return false;
   }
 }
 
 }  // namespace blink