Fixed traversal bug in CSSValueList::removeAll

Source/core/css/CSSValueList.cpp

Index: Source/core/css/CSSValueList.cpp
diff --git a/Source/core/css/CSSValueList.cpp b/Source/core/css/CSSValueList.cpp
index 08d4e165620f856d4400f328fdae8dc393bbd5f6..1648f677020881dc368a930580cff5b98daf4748 100644
--- a/Source/core/css/CSSValueList.cpp
+++ b/Source/core/css/CSSValueList.cpp
@@ -41,7 +41,7 @@ CSSValueList::CSSValueList(ValueListSeparator listSeparator)
 bool CSSValueList::removeAll(CSSValue* val)
 {
     bool found = false;
-    for (size_t index = 0; index < m_values.size(); index++) {
+    for (int index = m_values.size() - 1; index >= 0; --index) {
         RefPtrWillBeMember<CSSValue>& value = m_values.at(index);
         if (value && val && value->equals(*val)) {
             m_values.remove(index);