Preserve shape-box order in non-computed values

Source/core/css/parser/CSSPropertyParser.cpp

 /*
  * Copyright (C) 2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
@@ skipping 4416 matching lines @@
         m_valueList->next();
         return keywordValue.release();
     }
 
     RefPtrWillBeRawPtr<CSSValue> imageValue;
     if (valueId != CSSValueNone && parseFillImage(m_valueList.get(), imageValue)) {
         m_valueList->next();
         return imageValue.release();
     }
 
-    if (value->unit == CSSParserValue::Function) {
-        shapeValue = parseBasicShape();
-        if (!shapeValue)
-            return nullptr;
-    } else if (isBoxValue(valueId)) {
-        boxValue = parseValidPrimitive(valueId, value);
-        m_valueList->next();
-    } else {
-        return nullptr;
-    }
+    return parseBasicShapeAndOrBox();
+}
 
-    ASSERT(shapeValue || boxValue);
-    value = m_valueList->current();
+PassRefPtrWillBeRawPtr<CSSValue> CSSPropertyParser::parseBasicShapeAndOrBox()
+{
+    CSSParserValue* value = m_valueList->current();
 
-    if (value) {
+    bool shapeFound = false;
+    bool boxFound = false;
+    CSSValueID valueId;
+
+    RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
+    for (unsigned i = 0; i < 2; ++i) {
+        if (!value)
+            break;
         valueId = value->id;
-        if (boxValue && value->unit == CSSParserValue::Function) {
-            shapeValue = parseBasicShape();
+        if (value->unit == CSSParserValue::Function && !shapeFound) {
+            // parseBasicShape already asks for the next value list item.
+            RefPtr<CSSPrimitiveValue> shapeValue = parseBasicShape();
             if (!shapeValue)
                 return nullptr;
-        } else if (shapeValue && isBoxValue(valueId)) {
-            boxValue = parseValidPrimitive(valueId, value);
+            list->append(shapeValue.release());
+            shapeFound = true;
+        } else if (isBoxValue(valueId) && !boxFound) {
+            list->append(parseValidPrimitive(valueId, value));
+            boxFound = true;
             m_valueList->next();
         } else {
             return nullptr;
         }
 
-        ASSERT(shapeValue && boxValue);
-        shapeValue->getShapeValue()->setLayoutBox(boxValue.release());
+        value = m_valueList->current();
     }
 
-    if (shapeValue)
-        return shapeValue.release();
-    return boxValue.release();
+    if (m_valueList->current())
+        return nullptr;
+    return list.release();
 }
 
 PassRefPtrWillBeRawPtr<CSSPrimitiveValue> CSSPropertyParser::parseBasicShape()
 {
     CSSParserValue* value = m_valueList->current();
     ASSERT(value->unit == CSSParserValue::Function);
     CSSParserValueList* args = value->function->args.get();
 
     if (!args)
         return nullptr;
@@ skipping 3956 matching lines @@
         parsedValues->append(CSSPrimitiveValue::createIdentifier(CSSValueFill));
     if (!seenStroke)
         parsedValues->append(CSSPrimitiveValue::createIdentifier(CSSValueStroke));
     if (!seenMarkers)
         parsedValues->append(CSSPrimitiveValue::createIdentifier(CSSValueMarkers));
 
     return parsedValues.release();
 }
 
 } // namespace WebCore