Do not accept CSS-wide keywords for descriptors

third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp

Index: third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
diff --git a/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp b/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
index d3e97946da8a84ca86649600b0c1a87106ab94d6..51ee5fff51e531c349c233442e1d78f0c90e64db 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
@@ -305,10 +305,13 @@ bool CSSPropertyParser::consumeCSSWideKeyword(CSSPropertyID unresolvedProperty,
 
     CSSPropertyID property = resolveCSSPropertyID(unresolvedProperty);
     const StylePropertyShorthand& shorthand = shorthandForProperty(property);
-    if (!shorthand.length())
+    if (!shorthand.length()) {
+        if (CSSPropertyMetadata::isDescriptor(unresolvedProperty))
+            return false;
         addProperty(property, CSSPropertyInvalid, value, important);
-    else
+    } else {
         addExpandedPropertyForValue(property, value, important);
+    }
     m_range = rangeCopy;
     return true;
 }
@@ -3976,6 +3979,11 @@ CSSValue* CSSPropertyParser::parseSingleValue(CSSPropertyID unresolvedProperty,
     }
 }
 
+static CSSPrimitiveValue* consumeFontDisplay(CSSParserTokenRange& range)
+{
+    return consumeIdent<CSSValueAuto, CSSValueBlock, CSSValueSwap, CSSValueFallback, CSSValueOptional>(range);
+}
+
 static CSSValueList* consumeFontFaceUnicodeRange(CSSParserTokenRange& range)
 {
     CSSValueList* values = CSSValueList::createCommaSeparated();
@@ -4069,6 +4077,8 @@ bool CSSPropertyParser::parseFontFaceDescriptor(CSSPropertyID propId)
         parsedValue = consumeFontFaceUnicodeRange(m_range);
         break;
     case CSSPropertyFontDisplay:
+        parsedValue = consumeFontDisplay(m_range);
+        break;
     case CSSPropertyFontStretch:
     case CSSPropertyFontStyle: {
         CSSValueID id = m_range.consumeIncludingWhitespace().id();