Shorthand serialization should check for var in longhands.

third_party/WebKit/Source/core/css/StylePropertySerializer.cpp

 /*
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
  * Copyright (C) 2013 Intel Corporation. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 382 matching lines @@
         if (value.isImplicitInitialValue()) {
             if (allowImplicitInitial)
                 continue;
             return emptyString();
         }
         if (!allowInitial && value.isInitialValue())
             return emptyString();
         // TODO(timloh): This should also check unset
         if (value.isInheritedValue())
             return emptyString();
+        if (value.isVariableReferenceValue())
+            return emptyString();
     }
 
     return String();
 }
 
 String StylePropertySerializer::getPropertyValue(CSSPropertyID propertyID) const
 {
     const StylePropertyShorthand& shorthand = shorthandForProperty(propertyID);
     // TODO(timloh): This is weird, why do we call this with non-shorthands at all?
     if (!shorthand.length())
@@ skipping 468 matching lines @@
             builder.append(", ");
 
         const CSSValue& xValue = repeatXList ? repeatXList->item(i % repeatXList->length()) : repeatX;
         const CSSValue& yValue = repeatYList ? repeatYList->item(i % repeatYList->length()) : repeatY;
         appendBackgroundRepeatValue(builder, xValue, yValue);
     }
     return builder.toString();
 }
 
 } // namespace blink