Ensure that we don't allow 'normal' alongside other values in content property

third_party/WebKit/Source/core/css/resolver/StyleBuilderCustom.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2004-2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Nicholas Shanks (webkit@nickshanks.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (c) 2011, Code Aurora Forum. All rights reserved.
@@ skipping 639 matching lines @@
 }
 
 void StyleBuilderFunctions::applyInheritCSSPropertyContent(StyleResolverState&)
 {
     // FIXME: In CSS3, it will be possible to inherit content. In CSS2 it is not. This
     // note is a reminder that eventually "inherit" needs to be supported.
 }
 
 void StyleBuilderFunctions::applyValueCSSPropertyContent(StyleResolverState& state, CSSValue* value)
 {
+    if (value->isPrimitiveValue()) {
+        ASSERT(toCSSPrimitiveValue(*value).getValueID() == CSSValueNormal);
+        state.style()->clearContent();
+        return;
+    }
     // list of string, uri, counter, attr, i
 
     bool didSet = false;
     for (auto& item : toCSSValueList(*value)) {
         if (item->isImageGeneratorValue()) {
             state.style()->setContent(StyleGeneratedImage::create(toCSSImageGeneratorValue(*item)), didSet);
             didSet = true;
         } else if (item->isImageSetValue()) {
             state.style()->setContent(state.elementStyleResources().setOrPendingFromValue(CSSPropertyContent, toCSSImageSetValue(*item)), didSet);
             didSet = true;
@@ skipping 48 matching lines @@
                 break;
             case CSSValueNoOpenQuote:
                 state.style()->setContent(NO_OPEN_QUOTE, didSet);
                 didSet = true;
                 break;
             case CSSValueNoCloseQuote:
                 state.style()->setContent(NO_CLOSE_QUOTE, didSet);
                 didSet = true;
                 break;
             default:
                 // normal and none do not have any effect.

[Timothy Loh, 2016/03/29 06:52:40]

also remove the comment because it doesn't make sense any more

-                { }
+                ASSERT_NOT_REACHED();
             }
         }
     }
-    if (!didSet)
-        state.style()->clearContent();
+    ASSERT(didSet);
+    state.style()->clearContent();

[Timothy Loh, 2016/03/29 06:51:38]

...this is wrong, this just makes us never have content any more

 }
 
 void StyleBuilderFunctions::applyValueCSSPropertyWebkitLocale(StyleResolverState& state, CSSValue* value)
 {
     if (value->isPrimitiveValue()) {
         ASSERT(toCSSPrimitiveValue(value)->getValueID() == CSSValueAuto);
         state.fontBuilder().setLocale(nullAtom);
     } else {
         state.fontBuilder().setLocale(AtomicString(toCSSStringValue(value)->value()));
     }
@@ skipping 97 matching lines @@
     }
 }
 
 void StyleBuilderFunctions::applyInheritCSSPropertyPosition(StyleResolverState& state)
 {
     if (!state.parentNode()->isDocumentNode())
         state.style()->setPosition(state.parentStyle()->position());
 }
 
 } // namespace blink