[css-grid] Fix crash clamping grid lines

third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp

Index: third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
diff --git a/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp b/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
index 39ac942aad9b8ce76275ccacdd4eb1b6a9b68713..ed601721d3060b50648635bb01ba9d65beadd763 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
@@ -3021,6 +3021,12 @@ static CSSValue* consumeGridLine(CSSParserTokenRange& range) {
     return nullptr;  // An <integer> value of zero makes the declaration
                      // invalid.
 
+  if (numericValue) {
+    numericValue = CSSPrimitiveValue::create(
+        clampTo(numericValue->getIntValue(), -kGridMaxTracks, kGridMaxTracks),
+        CSSPrimitiveValue::UnitType::Integer);
+  }
+
   CSSValueList* values = CSSValueList::createSpaceSeparated();
   if (spanValue)
     values->append(*spanValue);