Clamp rgba(...) alpha value in the CSS fast-path parser

third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSParserFastPaths.h"
 
 #include "core/StylePropertyShorthand.h"
 #include "core/css/CSSColorValue.h"
 #include "core/css/CSSFunctionValue.h"
 #include "core/css/CSSIdentifierValue.h"
@@ skipping 357 matching lines @@
     static const int tenthAlphaValues[] = {0,   25,  51,  76,  102,
                                            127, 153, 179, 204, 230};
     value = negative ? 0 : tenthAlphaValues[string[length - 2] - '0'];
     string = end;
     return true;
   }
 
   double alpha = 0;
   if (!parseDouble(string, end, terminator, alpha))
     return false;
-  value = negative ? 0 : static_cast<int>(alpha * nextafter(256.0, 0.0));
+  value = negative
+              ? 0
+              : static_cast<int>(std::min(alpha, 1.0) * nextafter(256.0, 0.0));

[alancutter (OOO until 2018), 2016/12/20 23:31:24]

Instead of static_cast can we use clampTo<int>?

[fs, 2016/12/21 08:53:00]

We can, but it would be a waste of perfectly good CPU cycles. (Converting from a
double in [0, 256) to an int cannot overflow the int, so the roughly handful of
extra instructions will not do anything.)

   string = end;
   return true;
 }
 
 template <typename CharacterType>
 static inline bool mightBeRGBA(const CharacterType* characters,
                                unsigned length) {
   if (length < 5)
     return false;
   return characters[4] == '(' &&
@@ skipping 812 matching lines @@
   if (isColorPropertyID(propertyID))
     return parseColor(string, parserMode);
   if (CSSValue* keyword = parseKeywordValue(propertyID, string, parserMode))
     return keyword;
   if (CSSValue* transform = parseSimpleTransform(propertyID, string))
     return transform;
   return nullptr;
 }
 
 }  // namespace blink