Implement stricter hashless hex color parsing

third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp

Index: third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp
diff --git a/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp b/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp
index 0fe218a71e5f9fa77ac5318125288cde0d22eb9b..f31c21d360fd6cc679896b3cee794f813676547a 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp
@@ -405,14 +405,16 @@ static bool parseHexColor(CSSParserTokenRange& range, RGBA32& result, bool accep
     const CSSParserToken& token = range.peek();
     String color;
     if (acceptQuirkyColors) {
-        if (token.type() == NumberToken && token.numericValueType() == IntegerValueType
-            && token.numericValue() >= 0. && token.numericValue() < 1000000.) { // e.g. 112233
+        if (token.type() == NumberToken) { // e.g. 112233
+            if (token.numericValueType() != IntegerValueType
+                || token.numericValue() < 0. || token.numericValue() >= 1000000.)
+                return false;
             color = String::format("%06d", static_cast<int>(token.numericValue()));
         } else if (token.type() == DimensionToken) { // e.g. 0001FF
-            // TODO(timloh): This should check the numericValueType flag
-            color = String::number(static_cast<int>(token.numericValue())) + String(token.value());
-            if (color.length() > 6)
+            if (token.numericValueType() != IntegerValueType
+                || token.numericValue() < 0. || token.numericValue() > std::numeric_limits<int>::max())

[Timothy Loh, 2016/05/11 02:12:55]

Why not compare to 10^6, similar to number types?

[rwlbuis, 2016/05/11 02:28:47]

Ah, I got confused by https://codereview.chromium.org/1936913002/ , guess 10^6
is fine then. Seems also like we can lump the NumberToken and DimensionToken
blocks together. Will fix tomorrow.

                 return false;
+            color = String::number(static_cast<int>(token.numericValue())) + String(token.value());
             while (color.length() < 6)
                 color = "0" + color;
         } else if (token.type() == IdentToken) { // e.g. FF0000