Prevent floating point overflow when using calc() with large values

third_party/WebKit/Source/platform/LengthFunctions.cpp

 /*
     Copyright (C) 1999 Lars Knoll (knoll@kde.org)
     Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
     Copyright (C) 2011 Rik Cabanier (cabanier@adobe.com)
     Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
     Copyright (C) 2012 Motorola Mobility, Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ skipping 20 matching lines @@
 
 int intValueForLength(const Length& length, int maximumValue) {
   return valueForLength(length, LayoutUnit(maximumValue)).toInt();
 }
 
 float floatValueForLength(const Length& length, float maximumValue) {
   switch (length.type()) {
     case Fixed:
       return length.getFloatValue();
     case Percent:
-      return static_cast<float>(maximumValue * length.percent() / 100.0f);
+      return clampTo<float>(maximumValue * length.percent() / 100.0f);

[eae, 2017/01/03 04:37:30]

clampTo is significantly more expensive than a static_cast. You might wan to
consider using saturation arithmetic instead. At the very least please be aware
of the overhead and monitor our perf tests and numbers carefully.

[alancutter (OOO until 2018), 2017/01/03 05:17:02]

The performance impact of this is a bit scary actually. The undefined behaviour
fuzzer never highlighted this file so I might just leave it alone and stick with
just fixing calc() code instead.

     case FillAvailable:
     case Auto:
-      return static_cast<float>(maximumValue);
+      return maximumValue;
     case Calculated:
       return length.nonNanCalculatedValue(LayoutUnit(maximumValue));
     case MinContent:
     case MaxContent:
     case FitContent:
     case ExtendToZoom:
     case DeviceWidth:
     case DeviceHeight:
     case MaxSizeNone:
       ASSERT_NOT_REACHED();
@@ skipping 69 matching lines @@
                    floatValueForLength(lengthSize.height(), boxSize.height()));
 }
 
 FloatPoint floatPointForLengthPoint(const LengthPoint& LengthPoint,
                                     const FloatSize& boxSize) {
   return FloatPoint(floatValueForLength(LengthPoint.x(), boxSize.width()),
                     floatValueForLength(LengthPoint.y(), boxSize.height()));
 }
 
 }  // namespace blink