Media feature values are parsed as double values but stored as unsigned integers internally. We are currently casting double to unsigned. Instead we should clamp.
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/cf115265d17e7eec4e8c6c2d4441942988dc84db commit cf115265d17e7eec4e8c6c2d4441942988dc84db Author: rune <rune@opera.com> Date: Thu Apr 27 07:13:49 2017 Better overflow handling for aspect-ratio MQ. This change fixes two issues: 1. Clamp instead of casting double values from parser to internal unsigned storage. 2. Promote width/height/numerator/denominator multiplications to double to avoid integer overflow for large numerator/denominators. R=yoav@yoav.ws,suzyh@chromium.org BUG= 676709 , 714079 Review-Url: https://codereview.chromium.org/2836613002 Cr-Commit-Position: refs/heads/master@{#467615} [add] https://crrev.com/cf115265d17e7eec4e8c6c2d4441942988dc84db/third_party/WebKit/LayoutTests/fast/media/mq-aspect-ratio-overflow.html [modify] https://crrev.com/cf115265d17e7eec4e8c6c2d4441942988dc84db/third_party/WebKit/Source/core/css/MediaQueryEvaluator.cpp [modify] https://crrev.com/cf115265d17e7eec4e8c6c2d4441942988dc84db/third_party/WebKit/Source/core/css/MediaQueryEvaluatorTest.cpp [modify] https://crrev.com/cf115265d17e7eec4e8c6c2d4441942988dc84db/third_party/WebKit/Source/core/css/MediaQueryExp.cpp
Comment 1 by shend@chromium.org
, Apr 23 2017