[CSS] Accept 8 (#RRGGBBAA) and 4 (#RGBA) value hex colors

third_party/WebKit/Source/core/html/HTMLElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004-2008, 2013, 2014 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2011 Motorola Mobility. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 909 matching lines @@
     // An empty string doesn't apply a color. (One containing only whitespace does, which is why this check occurs before stripping.)
     if (attributeValue.isEmpty())
         return;
 
     String colorString = attributeValue.stripWhiteSpace();
 
     // "transparent" doesn't apply a color either.
     if (equalIgnoringCase(colorString, "transparent"))
         return;
 
-    // If the string is a named CSS color or a 3/6-digit hex color, use that.
-    Color parsedColor;
-    if (!parsedColor.setFromString(colorString))
-        parsedColor.setRGB(parseColorStringWithCrazyLegacyRules(colorString));
+    Color color;
 
-    style->setProperty(propertyID, cssValuePool().createColorValue(parsedColor.rgb()));
+    // If the string is a 3/6-digit hex color or a named CSS color, use that. Apply legacy rules otherwise. Note color.setFromString()
+    // accepts 4/8-digit hex colors, so restrict its use with length checks here to support legacy HTML attribute colors.
+
+    bool success = false;
+    if ((colorString.length() == 4 || colorString.length() == 7) && colorString[0] == '#')
+        success = color.setFromString(colorString);
+    if (!success)
+        success = color.setNamedColor(colorString);
+    if (!success)
+        color.setRGB(parseColorStringWithCrazyLegacyRules(colorString));
+
+    style->setProperty(propertyID, cssValuePool().createColorValue(color.rgb()));
 }
 
 bool HTMLElement::isInteractiveContent() const
 {
     return false;
 }
 
 HTMLMenuElement* HTMLElement::assignedContextMenu() const
 {
     if (HTMLMenuElement* menu = contextMenu())
@@ skipping 93 matching lines @@
 #ifndef NDEBUG
 
 // For use in the debugger
 void dumpInnerHTML(blink::HTMLElement*);
 
 void dumpInnerHTML(blink::HTMLElement* element)
 {
     printf("%s\n", element->innerHTML().ascii().data());
 }
 #endif