Add CSS parser recovery from errors while parsing @-webkit-keyframes key values.

Source/core/css/CSSParser.cpp

Index: Source/core/css/CSSParser.cpp
diff --git a/Source/core/css/CSSParser.cpp b/Source/core/css/CSSParser.cpp
index d5986b7312f64ce49759eb68bd6df02d68bff85b..87777eb329f57752a79db97f614daf82c95aecb9 100644
--- a/Source/core/css/CSSParser.cpp
+++ b/Source/core/css/CSSParser.cpp
@@ -11278,8 +11278,25 @@ StyleKeyframe* CSSParser::createKeyframe(CSSParserValueList* keys)
 {
     // Create a key string from the passed keys
     StringBuilder keyString;
+
     for (unsigned i = 0; i < keys->size(); ++i) {
+        // Just as per the comment below, we ignore keyframes with
+        // invalid key values (plain numbers or unknown identifiers)
+        // marked as isInt during parsing.
+        if (keys->valueAt(i)->unit == CSSParserValue::Invalid) {
+            clearProperties();
+            return 0;
+        }
+
+        ASSERT(keys->valueAt(i)->unit == CSSPrimitiveValue::CSS_NUMBER);
         float key = static_cast<float>(keys->valueAt(i)->fValue);
+        if (key < 0 || key > 100) {
+            // As per http://www.w3.org/TR/css3-animations/#keyframes,
+            // "If a keyframe selector specifies negative percentage values
+            // or values higher than 100%, then the keyframe will be ignored."
+            clearProperties();
+            return 0;
+        }
         if (i != 0)
             keyString.append(',');
         keyString.append(String::number(key));