[css-grid] Consider invalid using just "span" as grid-line value

third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSPropertyParser.h"
 
 #include "core/StylePropertyShorthand.h"
 #include "core/css/CSSBasicShapeValues.h"
 #include "core/css/CSSBorderImage.h"
 #include "core/css/CSSContentDistributionValue.h"
@@ skipping 3132 matching lines @@
                 numericValue = consumeInteger(range);
                 spanValue = consumeIdent<CSSValueSpan>(range);
                 if (!spanValue && !numericValue)
                     return gridLineName;
             } else {
                 return nullptr;
             }
         }
     }
 
+    if (spanValue && !numericValue && !gridLineName)
+        return nullptr; // "span" keyword alone is invalid.
     if (spanValue && numericValue && numericValue->getIntValue() < 0)
         return nullptr; // Negative numbers are not allowed for span.
     if (numericValue && numericValue->getIntValue() == 0)
         return nullptr; // An <integer> value of zero makes the declaration invalid.
 
     CSSValueList* values = CSSValueList::createSpaceSeparated();
     if (spanValue)
         values->append(spanValue);
     if (numericValue)
         values->append(numericValue);
@@ skipping 1868 matching lines @@
     case CSSPropertyGridTemplate:
         return consumeGridTemplateShorthand(CSSPropertyGridTemplate, important);
     case CSSPropertyGrid:
         return consumeGridShorthand(important);
     default:
         return false;
     }
 }
 
 } // namespace blink