Ensure that we don't allow 'normal' alongside other values in content property

third_party/WebKit/Source/core/css/resolver/StyleBuilderCustom.cpp

Index: third_party/WebKit/Source/core/css/resolver/StyleBuilderCustom.cpp
diff --git a/third_party/WebKit/Source/core/css/resolver/StyleBuilderCustom.cpp b/third_party/WebKit/Source/core/css/resolver/StyleBuilderCustom.cpp
index cfdc3f80e9ffc9b15b0e46129032835f1061f681..b9486c4feb43d3ed2a43eabc1b196d66c533c42f 100644
--- a/third_party/WebKit/Source/core/css/resolver/StyleBuilderCustom.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/StyleBuilderCustom.cpp
@@ -657,6 +657,11 @@ void StyleBuilderFunctions::applyInheritCSSPropertyContent(StyleResolverState&)
 
 void StyleBuilderFunctions::applyValueCSSPropertyContent(StyleResolverState& state, CSSValue* value)
 {
+    if (value->isPrimitiveValue()) {
+        ASSERT(toCSSPrimitiveValue(*value).getValueID() == CSSValueNormal);
+        state.style()->clearContent();
+        return;
+    }
     // list of string, uri, counter, attr, i
 
     bool didSet = false;
@@ -726,12 +731,12 @@ void StyleBuilderFunctions::applyValueCSSPropertyContent(StyleResolverState& sta
                 break;
             default:
                 // normal and none do not have any effect.

[Timothy Loh, 2016/03/29 06:52:40]

also remove the comment because it doesn't make sense any more

-                { }
+                ASSERT_NOT_REACHED();
             }
         }
     }
-    if (!didSet)
-        state.style()->clearContent();
+    ASSERT(didSet);
+    state.style()->clearContent();

[Timothy Loh, 2016/03/29 06:51:38]

...this is wrong, this just makes us never have content any more

 }
 
 void StyleBuilderFunctions::applyValueCSSPropertyWebkitLocale(StyleResolverState& state, CSSValue* value)