Clamp result to float range when resolving percentage lengths

Bug: 1155018
Change-Id: Ia2c76552745a9b1499f7339f00aacb6c34203e2b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2578376Reviewed-by: Anders Hartvoll Ruud <andruud@chromium.org>
Reviewed-by: Chris Harrelson <chrishtr@chromium.org>
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#835277}

third_party/blink/renderer/platform/BUILD.gn

@@ -1976,6 +1976,7 @@ source_set("blink_platform_unittests_sources") {
     "geometry/layout_rect_test.cc",
     "geometry/layout_size_test.cc",
     "geometry/layout_unit_test.cc",
+    "geometry/length_functions_test.cc",
     "geometry/length_test.cc",
     "geometry/region_test.cc",
     "graphics/accelerated_static_bitmap_image_test.cc",

third_party/blink/renderer/platform/geometry/length_functions.cc

@@ -40,7 +40,7 @@ float FloatValueForLength(const Length& length, float maximum_value) {
     case Length::kFixed:
       return length.GetFloatValue();
     case Length::kPercent:
-      return static_cast<float>(maximum_value * length.Percent() / 100.0f);
+      return clampTo<float>(maximum_value * length.Percent() / 100.0f);
     case Length::kFillAvailable:
     case Length::kAuto:
       return static_cast<float>(maximum_value);

third_party/blink/renderer/platform/geometry/length_functions_test.cc

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
+
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace blink {
+
+TEST(LengthFunctionsTest, OutOfRangePercentage) {
+  Length max = Length::Percent(std::numeric_limits<float>::max());
+  float value = FloatValueForLength(max, 800);
+  EXPECT_TRUE(isfinite(value));
+}
+
+}  // namespace blink

third_party/blink/renderer/platform/transforms/transform_operations_test.cc

@@ -736,4 +736,33 @@ TEST(TransformOperationsTest, SizeDependenciesCombineTest) {
   EXPECT_EQ(ops.BoxSizeDependencies(), TransformOperation::kDependsBoth);
 }
 
+// https://crbug.com/1155018
+TEST(TransformOperationsTest, OutOfRangePercentage) {
+  TransformOperations ops;
+  ops.Operations().push_back(TranslateTransformOperation::Create(
+      Length::Percent(std::numeric_limits<float>::max()), Length::Percent(50),
+      TransformOperation::kTranslate));
+
+  TransformationMatrix mat;
+  ops.Apply(FloatSize(800, 600), mat);
+
+  // There should not be inf or nan in the transformation result.
+  EXPECT_TRUE(isfinite(mat.M11()));
+  EXPECT_TRUE(isfinite(mat.M12()));
+  EXPECT_TRUE(isfinite(mat.M13()));
+  EXPECT_TRUE(isfinite(mat.M14()));
+  EXPECT_TRUE(isfinite(mat.M21()));
+  EXPECT_TRUE(isfinite(mat.M22()));
+  EXPECT_TRUE(isfinite(mat.M23()));
+  EXPECT_TRUE(isfinite(mat.M24()));
+  EXPECT_TRUE(isfinite(mat.M31()));
+  EXPECT_TRUE(isfinite(mat.M32()));
+  EXPECT_TRUE(isfinite(mat.M33()));
+  EXPECT_TRUE(isfinite(mat.M34()));
+  EXPECT_TRUE(isfinite(mat.M41()));
+  EXPECT_TRUE(isfinite(mat.M42()));
+  EXPECT_TRUE(isfinite(mat.M43()));
+  EXPECT_TRUE(isfinite(mat.M44()));
+}
+
 }  // namespace blink