When you set:
1. i = 0x4000 (line 10) then "Uncaught RangeError: Invalid string length at color-crash.html:12" can be seen.
2. i = 0x100  (line 10) then there is no problem at all.

CSS parsing issue?

Able to reproduce this issue on Win7.

Able to reproduce the issue on Windows 7,Mac 10.12.5 & Ubuntu 14.04 using latest chrome stable#59.0.3071.115 & Canary#61.0.3152.0 as per the provided html in comment#0.

Tab crashed upon opening the html file.

This is non regression issue observed from M45,hence marking it as Untriaged to get more inputs from dev.

Please find the attached screenshot for reference.
Thank you..!!

Deleted: Crash.PNG 171 KB

	Crash.PNG 171 KB View Download

Seems like this is hitting an allocation limit:
[1:1:0710/110346.115988:1729119947146:FATAL:PartitionAllocator.h(37)] Check failed: count <= MaxElementCountInBackingStore<T>() (156590080 vs. 89478314)
#0 0x00000165d257 base::debug::StackTrace::StackTrace()
#1 0x0000016705dd logging::LogMessage::~LogMessage()
#2 0x000002918a2c WTF::PartitionAllocator::QuantizedSize<>()
#3 0x0000029540d1 WTF::Vector<>::ReserveCapacity()
#4 0x000002954052 WTF::Vector<>::AppendSlowCase<>()
#5 0x0000029521f1 blink::CSSTokenizer::CSSTokenizer()
#6 0x000002938814 blink::CSSParserImpl::ParseValue()
#7 0x000002933a51 blink::CSSParser::ParseValue()
#8 0x000002924407 blink::MutableStylePropertySet::SetProperty()
#9 0x00000291291a blink::AbstractPropertySetCSSStyleDeclaration::SetPropertyInternal()
#10 0x000003a3111b blink::V8CSSStyleDeclaration::namedPropertySetterCustom()
#11 0x0000026625ba blink::V8CSSStyleDeclaration::namedPropertySetterCallback()

Adding timloh since AFAIK he is still the CSSTokenizer expert.

Is there any reason to handle this gracefully? What's the real-world use case for setting a color or whatnot to a string of 200 million characters?

Since that bug is a public one what about prevent trolling by script-kiddies? Anyway this bug could be used by anyone to do anything malicious to any Chrome/Chromium user.

What in particular does "anything malicious" entail? Being able to OOM the renderer by executing JS doesn't seem productive to anyone.

Well honestly I don't know how this could be used by non-trolls. I filled a bug before someone smarter than I start using it widely with a more productive case than I showed here:)

I don't think this is something we're too worried about, but thanks for the report, lysiol41! Marking as WontFix accordingly.

Thanks:)