IntersectionObserver constructor: fail on invalid rootMargin syntax.

third_party/WebKit/Source/core/dom/IntersectionObserver.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/dom/IntersectionObserver.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "core/css/parser/CSSParserTokenRange.h"
 #include "core/css/parser/CSSTokenizer.h"
 #include "core/dom/Element.h"
@@ skipping 21 matching lines @@
 static void parseRootMargin(String rootMarginParameter, Vector<Length>& rootMargin, ExceptionState& exceptionState)
 {
     // TODO(szager): Make sure this exact syntax and behavior is spec-ed somewhere.
 
     // The root margin argument accepts syntax similar to that for CSS margin:
     //
     // "1px" = top/right/bottom/left
     // "1px 2px" = top/bottom left/right
     // "1px 2px 3px" = top left/right bottom
     // "1px 2px 3px 4px" = top left right bottom
-    //
-    // Any extra stuff after the first four tokens is ignored.
     CSSTokenizer::Scope tokenizerScope(rootMarginParameter);
     CSSParserTokenRange tokenRange = tokenizerScope.tokenRange();
-    while (rootMargin.size() < 4 && tokenRange.peek().type() != EOFToken && !exceptionState.hadException()) {
+    while (tokenRange.peek().type() != EOFToken && !exceptionState.hadException()) {
+        if (rootMargin.size() == 4) {
+            exceptionState.throwDOMException(SyntaxError, "Extra text found at the end of rootMargin.");
+            break;
+        }
         const CSSParserToken& token = tokenRange.consumeIncludingWhitespace();
         switch (token.type()) {
         case PercentageToken:
             rootMargin.append(Length(token.numericValue(), Percent));
             break;
         case DimensionToken:
             switch (token.unitType()) {
             case CSSPrimitiveValue::UnitType::Pixels:
                 rootMargin.append(Length(static_cast<int>(floor(token.numericValue())), Fixed));
                 break;
@@ skipping 295 matching lines @@
 
 DEFINE_TRACE(IntersectionObserver)
 {
     visitor->template registerWeakMembers<IntersectionObserver, &IntersectionObserver::clearWeakMembers>(this);
     visitor->trace(m_callback);
     visitor->trace(m_observations);
     visitor->trace(m_entries);
 }
 
 } // namespace blink