[css-grid] Consider invalid using just "span" as grid-line value

third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp

Index: third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
diff --git a/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp b/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
index 565127705adba3e30bfe5e08269ffabb5055a199..8dd1e0729d5a418812e5dafeceb0f68de325627a 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
@@ -3150,6 +3150,8 @@ static CSSValue* consumeGridLine(CSSParserTokenRange& range)
         }
     }
 
+    if (spanValue && !numericValue && !gridLineName)
+        return nullptr; // "span" keyword alone is invalid.
     if (spanValue && numericValue && numericValue->getIntValue() < 0)
         return nullptr; // Negative numbers are not allowed for span.
     if (numericValue && numericValue->getIntValue() == 0)