Prevent floating point overflow when using calc() with large values

third_party/WebKit/Source/platform/LengthFunctions.cpp

Index: third_party/WebKit/Source/platform/LengthFunctions.cpp
diff --git a/third_party/WebKit/Source/platform/LengthFunctions.cpp b/third_party/WebKit/Source/platform/LengthFunctions.cpp
index e469e2ad439883a0012b5cbe9064d227ce1990d3..8f6bd55bd1460b9d56e26f1e9a27610d86fecfdf 100644
--- a/third_party/WebKit/Source/platform/LengthFunctions.cpp
+++ b/third_party/WebKit/Source/platform/LengthFunctions.cpp
@@ -38,10 +38,10 @@ float floatValueForLength(const Length& length, float maximumValue) {
     case Fixed:
       return length.getFloatValue();
     case Percent:
-      return static_cast<float>(maximumValue * length.percent() / 100.0f);
+      return clampTo<float>(maximumValue * length.percent() / 100.0f);

[eae, 2017/01/03 04:37:30]

clampTo is significantly more expensive than a static_cast. You might wan to
consider using saturation arithmetic instead. At the very least please be aware
of the overhead and monitor our perf tests and numbers carefully.

[alancutter (OOO until 2018), 2017/01/03 05:17:02]

The performance impact of this is a bit scary actually. The undefined behaviour
fuzzer never highlighted this file so I might just leave it alone and stick with
just fixing calc() code instead.

     case FillAvailable:
     case Auto:
-      return static_cast<float>(maximumValue);
+      return maximumValue;
     case Calculated:
       return length.nonNanCalculatedValue(LayoutUnit(maximumValue));
     case MinContent: