[CSS Shapes] CSS parser accepts trailing position arguments

Source/core/css/parser/CSSPropertyParser.cpp

 /*
  * Copyright (C) 2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
@@ skipping 4160 matching lines @@
             }
 
             return nullptr;
         }
 
         if (argument->id == CSSValueAt) {
             RefPtrWillBeRawPtr<CSSValue> centerX;
             RefPtrWillBeRawPtr<CSSValue> centerY;
             args->next(); // set list to start of position center
             parseFillPosition(args, centerX, centerY);
-            if (centerX && centerY) {
+            if (centerX && centerY && !args->current()) {
                 ASSERT(centerX->isPrimitiveValue());
                 ASSERT(centerY->isPrimitiveValue());
                 shape->setCenterX(toCSSPrimitiveValue(centerX.get()));
                 shape->setCenterY(toCSSPrimitiveValue(centerY.get()));
             } else {
                 return nullptr;
             }
         } else {
             return nullptr;
         }
@@ skipping 82 matching lines @@
 
             return nullptr;
         }
 
         if (argument->id != CSSValueAt)
             return nullptr;
         RefPtrWillBeRawPtr<CSSValue> centerX;
         RefPtrWillBeRawPtr<CSSValue> centerY;
         args->next(); // set list to start of position center
         parseFillPosition(args, centerX, centerY);
-        if (!centerX || !centerY)
+        if (!centerX || !centerY || args->current())
             return nullptr;
 
         ASSERT(centerX->isPrimitiveValue());
         ASSERT(centerY->isPrimitiveValue());
         shape->setCenterX(toCSSPrimitiveValue(centerX.get()));
         shape->setCenterY(toCSSPrimitiveValue(centerY.get()));
     }
 
     return shape;
 }
@@ skipping 217 matching lines @@
         shape = parseBasicShapePolygon(args);
     else if (equalIgnoringCase(value->function->name, "inset-rectangle("))
         shape = parseBasicShapeInsetRectangle(args);
     else if (equalIgnoringCase(value->function->name, "inset("))
         shape = parseBasicShapeInset(args);
 
     if (!shape)
         return nullptr;
 
     m_valueList->next();
+

[Bear Travis, 2014/03/11 00:15:26]

Small nit: extra newline added.

     return cssValuePool().createValue(shape.release());
 }
 
 // [ 'font-style' || 'font-variant' || 'font-weight' ]? 'font-size' [ / 'line-height' ]? 'font-family'
 bool CSSPropertyParser::parseFont(bool important)
 {
     // Let's check if there is an inherit or initial somewhere in the shorthand.
     for (unsigned i = 0; i < m_valueList->size(); ++i) {
         if (m_valueList->valueAt(i)->id == CSSValueInherit || m_valueList->valueAt(i)->id == CSSValueInitial)
             return false;
@@ skipping 3921 matching lines @@
         parsedValues->append(CSSPrimitiveValue::createIdentifier(CSSValueFill));
     if (!seenStroke)
         parsedValues->append(CSSPrimitiveValue::createIdentifier(CSSValueStroke));
     if (!seenMarkers)
         parsedValues->append(CSSPrimitiveValue::createIdentifier(CSSValueMarkers));
 
     return parsedValues.release();
 }
 
 } // namespace WebCore