Check @apply syntax in custom properties declarations at parse time

third_party/WebKit/Source/core/css/parser/CSSVariableParser.cpp

Index: third_party/WebKit/Source/core/css/parser/CSSVariableParser.cpp
diff --git a/third_party/WebKit/Source/core/css/parser/CSSVariableParser.cpp b/third_party/WebKit/Source/core/css/parser/CSSVariableParser.cpp
index a54302eac4ea4fbd6bd498d6e4ff525bb4b30a55..f75d27d8db56646ba167d145887ad5f190ca4ba1 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSVariableParser.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSVariableParser.cpp
@@ -48,10 +48,14 @@ bool classifyBlock(CSSParserTokenRange range, bool& hasReferences, bool isTopLev
         const CSSParserToken& token = range.consume();
         switch (token.type()) {
         case AtKeywordToken: {
-            // This might have false positives if the @apply doesn't actually match
-            // the syntax, but that just means we do extra computation work.
-            if (token.valueEqualsIgnoringASCIICase("apply"))
+            if (token.valueEqualsIgnoringASCIICase("apply")) {
+                range.consumeWhitespace();
+                const CSSParserToken& variableName = range.consumeIncludingWhitespace();
+                if (!CSSVariableParser::isValidVariableName(variableName)
+                    || !(range.atEnd() || range.peek().type() == SemicolonToken || range.peek().type() == RightBraceToken))
+                    return false;
                 hasReferences = true;
+            }
             break;
         }
         case DelimiterToken: {