Check for NaN in CFXJSE_FormCalcContext::WordNum()

Bug: chromium:947876
Change-Id: Ic37f077cddcfcb12e8b6fa66e93e2ab2cd1038e7
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/61910
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
diff --git a/fxjs/xfa/cfxjse_formcalc_context.cpp b/fxjs/xfa/cfxjse_formcalc_context.cpp
index b9971c9..0b65668 100644
--- a/fxjs/xfa/cfxjse_formcalc_context.cpp
+++ b/fxjs/xfa/cfxjse_formcalc_context.cpp
@@ -4397,7 +4397,8 @@
     bsLocale = ValueToUTF8String(localeValue.get());
   }
 
-  if (fNumber < 0.0f || fNumber > 922337203685477550.0f) {
+  if (std::isnan(fNumber) || fNumber < 0.0f ||
+      fNumber > 922337203685477550.0f) {
     args.GetReturnValue()->SetString("*");
     return;
   }