Clamp rgba(...) alpha value in the CSS fast-path parser

third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp

Index: third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp
diff --git a/third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp b/third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp
index b6055081c78276e0c4f9a86d6dbfaf386fe38ca8..19b0fb25922f37537ab040c552e34104e09ee99a 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp
@@ -375,7 +375,9 @@ static inline bool parseAlphaValue(const CharacterType*& string,
   double alpha = 0;
   if (!parseDouble(string, end, terminator, alpha))
     return false;
-  value = negative ? 0 : static_cast<int>(alpha * nextafter(256.0, 0.0));
+  value = negative
+              ? 0
+              : static_cast<int>(std::min(alpha, 1.0) * nextafter(256.0, 0.0));

[alancutter (OOO until 2018), 2016/12/20 23:31:24]

Instead of static_cast can we use clampTo<int>?

[fs, 2016/12/21 08:53:00]

We can, but it would be a waste of perfectly good CPU cycles. (Converting from a
double in [0, 256) to an int cannot overflow the int, so the roughly handful of
extra instructions will not do anything.)

   string = end;
   return true;
 }