Ensure that we don't allow 'normal' alongside other values in content property

third_party/WebKit/Source/core/css/resolver/StyleBuilderCustom.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2004-2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Nicholas Shanks (webkit@nickshanks.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (c) 2011, Code Aurora Forum. All rights reserved.
@@ skipping 639 matching lines @@
 }
 
 void StyleBuilderFunctions::applyInheritCSSPropertyContent(StyleResolverState&)
 {
     // FIXME: In CSS3, it will be possible to inherit content. In CSS2 it is not. This
     // note is a reminder that eventually "inherit" needs to be supported.
 }
 
 void StyleBuilderFunctions::applyValueCSSPropertyContent(StyleResolverState& state, CSSValue* value)
 {
+    if (value->isPrimitiveValue()) {
+        if (toCSSPrimitiveValue(*value).getValueID() == CSSValueNormal) {

[Timothy Loh, 2016/03/24 04:38:41]

should be an assert instead since if we get here this will always be true

[nainar, 2016/03/29 00:56:39]

Done.

+            state.style()->clearContent();
+            return;
+        }
+    }
     // list of string, uri, counter, attr, i
 
     bool didSet = false;
     for (auto& item : toCSSValueList(*value)) {
         if (item->isImageGeneratorValue()) {
             state.style()->setContent(StyleGeneratedImage::create(toCSSImageGeneratorValue(*item)), didSet);
             didSet = true;
         } else if (item->isImageSetValue()) {
             state.style()->setContent(state.elementStyleResources().setOrPendingFromValue(CSSPropertyContent, toCSSImageSetValue(*item)), didSet);
             didSet = true;
@@ skipping 172 matching lines @@
     }
 }
 
 void StyleBuilderFunctions::applyInheritCSSPropertyPosition(StyleResolverState& state)
 {
     if (!state.parentNode()->isDocumentNode())
         state.style()->setPosition(state.parentStyle()->position());
 }
 
 } // namespace blink