Prevent floating point overflow when using calc() with large values

third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
  * copyright notice, this list of conditions and the following disclaimer
  * in the documentation and/or other materials provided with the
  * distribution.
  *     * Neither the name of Google Inc. nor the names of its
@@ skipping 832 matching lines @@
     if (primitiveValue.isLength()) {
       return primitiveValue.computeLength<Length>(
           lineHeightToLengthConversionData(state));
     }
     if (primitiveValue.isPercentage()) {
       return Length(
           (state.style()->computedFontSize() * primitiveValue.getIntValue()) /
               100.0,
           Fixed);
     }
-    if (primitiveValue.isNumber())
-      return Length(primitiveValue.getDoubleValue() * 100.0, Percent);
+    if (primitiveValue.isNumber()) {
+      return Length(clampTo<float>(primitiveValue.getDoubleValue() * 100.0),
+                    Percent);
+    }
     if (primitiveValue.isCalculated()) {
       Length zoomedLength = Length(primitiveValue.cssCalcValue()->toCalcValue(
           lineHeightToLengthConversionData(state)));
       return Length(
           valueForLength(zoomedLength,
                          LayoutUnit(state.style()->computedFontSize())),
           Fixed);
     }
   }
 
@@ skipping 430 matching lines @@
       // Instead of the actual zoom, use 1 to avoid potential rounding errors
       Length length = primitiveValue.convertToLength(
           state.cssToLengthConversionData().copyWithAdjustedZoom(1));
       return *CSSPrimitiveValue::create(length, 1);
     }
   }
   return value;
 }
 
 }  // namespace blink