Only allow the -webkit-text color keyword in quirks/UA-sheet mode

Source/core/css/parser/CSSParserFastPaths.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/css/parser/CSSParserFastPaths.h"
 
 #include "core/StylePropertyShorthand.h"
 #include "core/css/CSSFunctionValue.h"
 #include "core/css/CSSValuePool.h"
@@ skipping 416 matching lines @@
 
     return false;
 }
 
 PassRefPtrWillBeRawPtr<CSSValue> CSSParserFastPaths::parseColor(const String& string, bool quirksMode)
 {
     ASSERT(!string.isEmpty());
     CSSParserString cssString;
     cssString.init(string);
     CSSValueID valueID = cssValueKeywordID(cssString);
-    if (valueID == CSSValueWebkitText || valueID == CSSValueCurrentcolor || valueID == CSSValueGrey
+    if (valueID == CSSValueCurrentcolor || valueID == CSSValueGrey
         || (valueID >= CSSValueAqua && valueID <= CSSValueWindowtext) || valueID == CSSValueMenu
-        || (quirksMode && valueID >= CSSValueWebkitFocusRingColor && valueID < CSSValueWebkitText))
+        || (quirksMode && valueID >= CSSValueWebkitFocusRingColor && valueID <= CSSValueWebkitText))
         return cssValuePool().createIdentifierValue(valueID);
 
     RGBA32 color;
 
     // Fast path for hex colors and rgb()/rgba() colors
     bool parseResult;
     if (string.is8Bit())
         parseResult = fastParseColorInternal(color, string.characters8(), string.length(), quirksMode);
     else
         parseResult = fastParseColorInternal(color, string.characters16(), string.length(), quirksMode);
@@ skipping 499 matching lines @@
     if (isColorPropertyID(propertyID))
         return parseColor(string, isQuirksModeBehavior(parserMode));
     if (RefPtrWillBeRawPtr<CSSValue> keyword = parseKeywordValue(propertyID, string))
         return keyword.release();
     if (RefPtrWillBeRawPtr<CSSValue> transform = parseSimpleTransform(propertyID, string))
         return transform.release();
     return nullptr;
 }
 
 } // namespace blink