Implement stricter hashless hex color parsing

third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp

Index: third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp
diff --git a/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp b/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp
index 49b1abb42138a4ef1369528973876cc8971d16e8..3d678d73a50c6ba9d7abf3f442380782b632241d 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp
@@ -405,14 +405,14 @@ static bool parseHexColor(CSSParserTokenRange& range, RGBA32& result, bool accep
     const CSSParserToken& token = range.peek();
     String color;
     if (acceptQuirkyColors) {
-        if (token.type() == NumberToken && token.numericValueType() == IntegerValueType
-            && token.numericValue() >= 0. && token.numericValue() < 1000000.) { // e.g. 112233
-            color = String::format("%06d", static_cast<int>(token.numericValue()));
-        } else if (token.type() == DimensionToken) { // e.g. 0001FF
-            // TODO(timloh): This should check the numericValueType flag
-            color = String::number(static_cast<int>(token.numericValue())) + String(token.value());
-            if (color.length() > 6)
+        if (token.type() == NumberToken || token.type() == DimensionToken) {
+            if (token.numericValueType() != IntegerValueType
+                || token.numericValue() < 0. || token.numericValue() >= 1000000.)
                 return false;
+            if (token.type() == NumberToken) // e.g. 112233
+                color = String::format("%d", static_cast<int>(token.numericValue()));
+            else // e.g. 0001FF
+                color = String::number(static_cast<int>(token.numericValue())) + String(token.value());
             while (color.length() < 6)
                 color = "0" + color;
         } else if (token.type() == IdentToken) { // e.g. FF0000