Implement stricter hashless hex color parsing

third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp

Index: third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp
diff --git a/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp b/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp
index 0fe218a71e5f9fa77ac5318125288cde0d22eb9b..c3ca48ea02f0b913be52904e7869d448040e256b 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp
@@ -405,14 +405,15 @@ static bool parseHexColor(CSSParserTokenRange& range, RGBA32& result, bool accep
     const CSSParserToken& token = range.peek();
     String color;
     if (acceptQuirkyColors) {
-        if (token.type() == NumberToken && token.numericValueType() == IntegerValueType
-            && token.numericValue() >= 0. && token.numericValue() < 1000000.) { // e.g. 112233
+        if (token.type() == NumberToken) { // e.g. 112233
+            if (token.numericValueType() != IntegerValueType
+                || token.numericValue() < 0. || token.numericValue() >= 1000000.)
+                return false;
             color = String::format("%06d", static_cast<int>(token.numericValue()));
         } else if (token.type() == DimensionToken) { // e.g. 0001FF
-            // TODO(timloh): This should check the numericValueType flag
-            color = String::number(static_cast<int>(token.numericValue())) + String(token.value());
-            if (color.length() > 6)
+            if (token.numericValueType() != IntegerValueType || token.numericValue() < 0.)
                 return false;
+            color = String::number(static_cast<int>(token.numericValue())) + String(token.value());

[rune, 2016/05/10 21:27:32]

What happens with the static_cast when numericValue() is larger than an int
(could happen since we store the int as a double)? Could the result be something
with less than 6 digits? Perhaps have an upper check as well?

[rwlbuis, 2016/05/10 21:34:31]

Good point! Will have a look.

             while (color.length() < 6)
                 color = "0" + color;
         } else if (token.type() == IdentToken) { // e.g. FF0000