[css-grid] Clamp the number of auto repeat tracks in all cases

third_party/WebKit/Source/core/layout/Grid.cpp

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/Grid.h"
 
 #include "core/layout/LayoutGrid.h"
 
 namespace blink {
 
@@ skipping 63 matching lines @@
 }
 
 #if DCHECK_IS_ON()
 bool Grid::hasAnyGridItemPaintOrder() const {
   return !m_gridItemsIndexesMap.isEmpty();
 }
 #endif
 
 void Grid::setAutoRepeatTracks(size_t autoRepeatRows,
                                size_t autoRepeatColumns) {
+  DCHECK_GE(static_cast<unsigned>(kGridMaxTracks),
+            numTracks(ForRows) + autoRepeatRows);
+  DCHECK_GE(static_cast<unsigned>(kGridMaxTracks),
+            numTracks(ForColumns) + autoRepeatColumns);
   m_autoRepeatRows = autoRepeatRows;
   m_autoRepeatColumns = autoRepeatColumns;
 }
 
 size_t Grid::autoRepeatTracks(GridTrackSizingDirection direction) const {
   return direction == ForRows ? m_autoRepeatRows : m_autoRepeatColumns;
 }
 
 void Grid::setAutoRepeatEmptyColumns(
     std::unique_ptr<OrderedTrackIndexSet> autoRepeatEmptyColumns) {
@@ skipping 135 matching lines @@
       // Advance the iterator to avoid an infinite loop where we would return
       // the same grid area over and over.
       ++varyingTrackIndex;
       return result;
     }
   }
   return nullptr;
 }
 
 }  // namespace blink