[css-grid] Fix crash clamping grid lines

third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp

Index: third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
diff --git a/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp b/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
index 39ac942aad9b8ce76275ccacdd4eb1b6a9b68713..4392c4060e9ae92e461cf991b0e24cf991d7717f 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
@@ -3021,6 +3021,16 @@ static CSSValue* consumeGridLine(CSSParserTokenRange& range) {
     return nullptr;  // An <integer> value of zero makes the declaration
                      // invalid.
 
+  if (numericValue) {

[jfernandez, 2016/12/02 12:28:03]

Wouldn't be better to define new CSSPrimitiveValue APIs ? Something like  
  - getIntValue(min, max)
  - clampIntValue(min, max)

[Manuel Rego, 2016/12/15 16:51:22]

Uploaded new version following this approach.

+    if (numericValue->getIntValue() > kGridMaxTracks) {
+      numericValue = CSSPrimitiveValue::create(
+          kGridMaxTracks, CSSPrimitiveValue::UnitType::Integer);
+    } else if (numericValue->getIntValue() < -kGridMaxTracks) {
+      numericValue = CSSPrimitiveValue::create(
+          -kGridMaxTracks, CSSPrimitiveValue::UnitType::Integer);
+    }
+  }
+
   CSSValueList* values = CSSValueList::createSpaceSeparated();
   if (spanValue)
     values->append(*spanValue);