Avoid float-cast-overflow in Cursor::ParseSingleValue.

R=futhark@chromium.org

Bug: 853062
Change-Id: I3cc1727fb5696b53810589994d864dcd579ddfc9
Reviewed-on: https://chromium-review.googlesource.com/1102325Reviewed-by: Rune Lillesveen <futhark@chromium.org>
Commit-Queue: Anders Ruud <andruud@chromium.org>
Cr-Commit-Position: refs/heads/master@{#567621}

third_party/WebKit/LayoutTests/fast/css/cursor-hotspot-computed-style.html

@@ -8,9 +8,13 @@
 #specifiedHotspot {
     cursor: url('file:///test.ico') 10 20, auto;
 }
+#intOverflowHotspot {
+    cursor: url('file:///test.ico') 3000000000 3000000000, auto;
+}
 </style>
 <div id="noSpecifiedHotspot"></div>
 <div id="specifiedHotspot"></div>
+<div id="intOverflowHotspot"></div>
 <script>
 test(function(){
     assert_equals(getComputedStyle(noSpecifiedHotspot).cursor, 'url("file:///test.ico"), auto');
@@ -19,4 +23,12 @@ test(function(){
 test(function(){
     assert_equals(getComputedStyle(specifiedHotspot).cursor, 'url("file:///test.ico") 10 20, auto');
 }, "Cursor computed style includes the hotspot if it's specified");
+
+test(function(){
+    let computedStyle = getComputedStyle(intOverflowHotspot).cursor;
+    let x = parseInt(computedStyle.split(' ')[1]);
+    let y = parseInt(computedStyle.split(' ')[2]);
+    assert_equals(x, 2147483647);
+    assert_equals(y, 2147483647);
+}, 'Hotspot coordinates clamp instead of overflowing');
 </script>
\ No newline at end of file

third_party/blink/renderer/core/css/properties/longhands/cursor_custom.cc

@@ -27,10 +27,10 @@ const CSSValue* Cursor::ParseSingleValue(CSSParserTokenRange& range,
     IntPoint hot_spot(-1, -1);
     bool hot_spot_specified = false;
     if (CSSPropertyParserHelpers::ConsumeNumberRaw(range, num)) {
-      hot_spot.SetX(int(num));
+      hot_spot.SetX(clampTo<int>(num));
       if (!CSSPropertyParserHelpers::ConsumeNumberRaw(range, num))
         return nullptr;
-      hot_spot.SetY(int(num));
+      hot_spot.SetY(clampTo<int>(num));
       hot_spot_specified = true;
     }