Prevent infinity evaluation from CSSMathInvert::SumValue if CSSCalcInfinityAndNaN feature is disabled
The DCHECK failure could happen if the value is evaluated to infinity or NaN.
Therefore, return nullopt from CSSMathInvert::SumValue when the value is 0 which will evaluate to infinity.
Bug: 1238543
Change-Id: I28cbafcdf5a4011d85c16ee8b925b75484d5db05
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3110170
Reviewed-by: Xiaocheng Hu <xiaochengh@chromium.org>
Reviewed-by: Mason Freed <masonf@chromium.org>
Commit-Queue: Seokho Song <0xdevssh@gmail.com>
Cr-Commit-Position: refs/heads/main@{#915011}
diff --git a/css/css-typed-om/stylevalue-serialization/crashtests/cssInvertValue-convert-crash.html b/css/css-typed-om/stylevalue-serialization/crashtests/cssInvertValue-convert-crash.html
new file mode 100644
index 0000000..8ca27ef
--- /dev/null
+++ b/css/css-typed-om/stylevalue-serialization/crashtests/cssInvertValue-convert-crash.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<link rel="author" href="mailto:0xdevssh@gmail.com">
+<link rel="help" href="https://crbug.com/1238543">
+<link rel="help" href="https://www.w3.org/TR/css-typed-om-1/">
+<meta name="assert" content="The renderer should not crash.">
+
+<p>This test passes if it does not crash.</p>
+<script>
+ var inverted = new CSSMathInvert(CSS.number(0));
+ var converted = inverted.to('number');
+ converted.toString()
+</script>
\ No newline at end of file
