Fixed traversal bug in CSSValueList::removeAll

Source/core/css/CSSValueList.cpp

 /*
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 23 matching lines @@
 
 CSSValueList::CSSValueList(ValueListSeparator listSeparator)
     : CSSValue(ValueListClass)
 {
     m_valueListSeparator = listSeparator;
 }
 
 bool CSSValueList::removeAll(CSSValue* val)
 {
     bool found = false;
-    for (size_t index = 0; index < m_values.size(); index++) {
+    for (int index = m_values.size() - 1; index >= 0; --index) {
         RefPtrWillBeMember<CSSValue>& value = m_values.at(index);
         if (value && val && value->equals(*val)) {
             m_values.remove(index);
             found = true;
         }
     }
 
     return found;
 }
 
@@ skipping 70 matching lines @@
     return false;
 }
 
 DEFINE_TRACE_AFTER_DISPATCH(CSSValueList)
 {
     visitor->trace(m_values);
     CSSValue::traceAfterDispatch(visitor);
 }
 
 } // namespace blink