IntersectionObserver constructor: fail on invalid rootMargin syntax.

third_party/WebKit/Source/core/dom/IntersectionObserver.cpp

Index: third_party/WebKit/Source/core/dom/IntersectionObserver.cpp
diff --git a/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp b/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp
index f67c1a9e27f5de3d64158bbcddb911508d6e4d5d..74f61567e94c0d12e223748e993d1262bbcdd469 100644
--- a/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp
+++ b/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp
@@ -39,11 +39,13 @@ static void parseRootMargin(String rootMarginParameter, Vector<Length>& rootMarg
     // "1px 2px" = top/bottom left/right
     // "1px 2px 3px" = top left/right bottom
     // "1px 2px 3px 4px" = top left right bottom
-    //
-    // Any extra stuff after the first four tokens is ignored.
     CSSTokenizer::Scope tokenizerScope(rootMarginParameter);
     CSSParserTokenRange tokenRange = tokenizerScope.tokenRange();
-    while (rootMargin.size() < 4 && tokenRange.peek().type() != EOFToken && !exceptionState.hadException()) {
+    while (rootMargin.size() < 5 && tokenRange.peek().type() != EOFToken && !exceptionState.hadException()) {
+        if (rootMargin.size() == 4) {

[eae, 2016/06/22 10:51:04]

According the the comment above four tokens should be allowed. (1px 2px 3px 4px)

[szager1, 2016/06/22 15:11:45]

At this point in the code, there are already four parsed tokens, and the loop is
about to process the fifth.  We know there's a fifth token, because the loop
conditional contains (tokenRange.peek().type() != EOFToken).

The existing tests verify that a rootMargin field with four tokens is
successfully parsed, and one with five tokens throws an exception.

[eae, 2016/06/22 16:54:40]

The while conditions check that rootMargin.size() is less than 5 and this
condition checks if it's four.  How can that indicate the presence of a fifth
token? Does tokenRange.peek() mutate the rootMargins vector?

I might be missing something obvious here but I fail to wrap my head around this
logic.

+            exceptionState.throwDOMException(SyntaxError, "Extra text found at the end of rootMargin.");
+            break;
+        }
         const CSSParserToken& token = tokenRange.consumeIncludingWhitespace();
         switch (token.type()) {
         case PercentageToken: