Add CSS parser recovery from errors while parsing @-webkit-keyframes key values.

Source/WebCore/css/CSSParser.cpp

Index: Source/WebCore/css/CSSParser.cpp
diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
index cd7145240a152a9f24daa8e0802844550f7d6a66..c1d65a6cc928ffba6159ea07df9be4d6eab9c71d 100644
--- a/Source/WebCore/css/CSSParser.cpp
+++ b/Source/WebCore/css/CSSParser.cpp
@@ -11278,8 +11278,23 @@ StyleKeyframe* CSSParser::createKeyframe(CSSParserValueList* keys)
 {
     // Create a key string from the passed keys
     StringBuilder keyString;
+
     for (unsigned i = 0; i < keys->size(); ++i) {
+        // Just as per the comment below, we ignore keyframes with
+        // invalid key values (plain numbers or unknown identifiers)
+        // marked as isInt during parsing.
+        if (keys->valueAt(i)->isInt) {
+            clearProperties();
+            return 0;
+        }
         float key = static_cast<float>(keys->valueAt(i)->fValue);
+        if (key < 0 || key > 100) {
+            // As per http://www.w3.org/TR/css3-animations/#keyframes,
+            // "If a keyframe selector specifies negative percentage values
+            // or values higher than 100%, then the keyframe will be ignored."
+            clearProperties();
+            return 0;
+        }
         if (i != 0)
             keyString.append(',');
         keyString.append(String::number(key));