Fix float-cast overflow in ToPositiveInteger

Currently in this function, we apply a roundf on a double value. We
should never do a roundf on a double value, it should just be round.

Bug: 994800
Change-Id: I6208d9db51661b2587ba54f949b9945ec47dcf3a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1761690
Commit-Queue: Xida Chen <xidachen@chromium.org>
Reviewed-by: Stephen McGruer <smcgruer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#688513}

third_party/blink/renderer/core/animation/svg_integer_optional_integer_interpolation_type.cc

@@ -41,7 +41,7 @@ SVGIntegerOptionalIntegerInterpolationType::MaybeConvertSVGValue(
 
 static SVGInteger* ToPositiveInteger(const InterpolableValue* number) {
   return MakeGarbageCollected<SVGInteger>(
-      clampTo<int>(roundf(ToInterpolableNumber(number)->Value()), 1));
+      clampTo<int>(round(ToInterpolableNumber(number)->Value()), 1));
 }
 
 SVGPropertyBase* SVGIntegerOptionalIntegerInterpolationType::AppliedSVGValue(

third_party/blink/web_tests/animations/svg-attribute-interpolation/svg-order-interpolation.html

@@ -22,6 +22,7 @@ assertAttributeInterpolation({
   {at: 0, is: '1 4'},
   {at: 1, is: '2 2'},
 ]);
+
 assertAttributeInterpolation({
   property: 'order',
   from: '2',
@@ -34,6 +35,7 @@ assertAttributeInterpolation({
   {at: 1, is: '2 2'},
   {at: 1.4, is: '2 2'}
 ]);
+
 assertAttributeInterpolation({
   property: 'order',
   from: '2',
@@ -42,6 +44,15 @@ assertAttributeInterpolation({
   {at: 0, is: '2 2'},
   {at: 1, is: '4 1'},
 ]);
+
+//Regression test for crbug.com/994800
+assertAttributeInterpolation({
+  property: 'order',
+  from: '1',
+  to: '3'
+}, [
+  {at: 3.40282e+038, is: '2147483647 , 2147483647'},
+]);
 </script>
 </body>
 </html>