Do not accept CSS-wide keywords for descriptors

third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSPropertyParser.h"
 
 #include "core/StylePropertyShorthand.h"
 #include "core/css/CSSBasicShapeValues.h"
 #include "core/css/CSSBorderImage.h"
 #include "core/css/CSSContentDistributionValue.h"
@@ skipping 287 matching lines @@
         value = cssValuePool().createExplicitInitialValue();
     else if (id == CSSValueInherit)
         value = cssValuePool().createInheritedValue();
     else if (id == CSSValueUnset)
         value = cssValuePool().createUnsetValue();
     else
         return false;
 
     CSSPropertyID property = resolveCSSPropertyID(unresolvedProperty);
     const StylePropertyShorthand& shorthand = shorthandForProperty(property);
-    if (!shorthand.length())
+    if (!shorthand.length()) {
+        if (CSSPropertyMetadata::isDescriptorOnly(unresolvedProperty))
+            return false;
         addProperty(property, CSSPropertyInvalid, value, important);
-    else
+    } else {
         addExpandedPropertyForValue(property, value, important);
+    }
     m_range = rangeCopy;
     return true;
 }
 
 static CSSValueList* consumeTransformOrigin(CSSParserTokenRange& range, CSSParserMode cssParserMode, UnitlessQuirk unitless)
 {
     CSSValue* resultX = nullptr;
     CSSValue* resultY = nullptr;
     if (consumeOneOrTwoValuedPosition(range, cssParserMode, unitless, resultX, resultY)) {
         CSSValueList* list = CSSValueList::createSpaceSeparated();
@@ skipping 3641 matching lines @@
         ASSERT(RuntimeEnabledFeatures::cssGridLayoutEnabled());
         return consumeGridTemplateAreas(m_range);
     case CSSPropertyGridAutoFlow:
         ASSERT(RuntimeEnabledFeatures::cssGridLayoutEnabled());
         return consumeGridAutoFlow(m_range);
     default:
         return nullptr;
     }
 }
 
+static CSSPrimitiveValue* consumeFontDisplay(CSSParserTokenRange& range)
+{
+    return consumeIdent<CSSValueAuto, CSSValueBlock, CSSValueSwap, CSSValueFallback, CSSValueOptional>(range);
+}
+
 static CSSValueList* consumeFontFaceUnicodeRange(CSSParserTokenRange& range)
 {
     CSSValueList* values = CSSValueList::createCommaSeparated();
 
     do {
         const CSSParserToken& token = range.consumeIncludingWhitespace();
         if (token.type() != UnicodeRangeToken)
             return nullptr;
 
         UChar32 start = token.unicodeRangeStart();
@@ skipping 73 matching lines @@
             return false;
         parsedValue = consumeFamilyName(m_range);
         break;
     case CSSPropertySrc: // This is a list of urls or local references.
         parsedValue = consumeFontFaceSrc(m_range, m_context);
         break;
     case CSSPropertyUnicodeRange:
         parsedValue = consumeFontFaceUnicodeRange(m_range);
         break;
     case CSSPropertyFontDisplay:
+        parsedValue = consumeFontDisplay(m_range);
+        break;
     case CSSPropertyFontStretch:
     case CSSPropertyFontStyle: {
         CSSValueID id = m_range.consumeIncludingWhitespace().id();
         if (!CSSParserFastPaths::isValidKeywordPropertyAndValue(propId, id, m_context.mode()))
             return false;
         parsedValue = cssValuePool().createIdentifierValue(id);
         break;
     }
     case CSSPropertyFontVariant:
         parsedValue = consumeFontVariantList(m_range);
@@ skipping 1092 matching lines @@
     case CSSPropertyGridTemplate:
         return consumeGridTemplateShorthand(CSSPropertyGridTemplate, important);
     case CSSPropertyGrid:
         return consumeGridShorthand(important);
     default:
         return false;
     }
 }
 
 } // namespace blink