Sanitize u, v with isNumeric

Author: degzhaus

src/traces/quiver/calc.js

@@ -47,8 +47,11 @@ module.exports = function calc(gd, trace) {
             cdi.y = BADNUM;
         }
 
-        var ui = uArr[i] || 0;
-        var vi = vArr[i] || 0;
+        // Sanitize u/v the same way as x/y: anything non-numeric (bad strings,
+        // Infinity, NaN, null, undefined) becomes a zero-length vector component
+        // so it can't poison norm/geometry downstream. Numeric strings are cast.
+        var ui = cdi.u = isNumeric(uArr[i]) ? +uArr[i] : 0;
+        var vi = cdi.v = isNumeric(vArr[i]) ? +vArr[i] : 0;
         var norm = Math.sqrt(ui * ui + vi * vi);
 
         if(isFinite(norm)) {
@@ -99,8 +102,8 @@ module.exports = function calc(gd, trace) {
     for(var k = 0; k < len; k++) {
         var xk = xVals[k];
         var yk = yVals[k];
-        var uk = uArr[k] || 0;
-        var vk = vArr[k] || 0;
+        var uk = cd[k].u;
+        var vk = cd[k].v;
         var nk = Math.sqrt(uk * uk + vk * vk);
 
         var baseLen;

src/traces/quiver/plot.js

@@ -119,8 +119,9 @@ function plotOne(gd, idx, plotinfo, cdscatter, cdscatterAll, element, transition
         // relative angle of the point of the arrowhead
         const headAngle = Math.PI / 12;
 
-        const u = (trace.u && trace.u[cdi.i]) || 0;
-        const v = (trace.v && trace.v[cdi.i]) || 0;
+        // u/v were sanitized in calc (non-numeric -> 0); reuse those values.
+        const u = cdi.u || 0;
+        const v = cdi.v || 0;
 
         const norm = Math.sqrt(u * u + v * v);
         const unitx = norm ? (u / norm) : 0;