Fix EditingStyle::mergeStyle()'s handling of custom properties

third_party/WebKit/LayoutTests/editing/execCommand/remove-format-variable-crash.html

Index: third_party/WebKit/LayoutTests/editing/execCommand/remove-format-variable-crash.html
diff --git a/third_party/WebKit/LayoutTests/editing/execCommand/remove-format-variable-crash.html b/third_party/WebKit/LayoutTests/editing/execCommand/remove-format-variable-crash.html
new file mode 100644
index 0000000000000000000000000000000000000000..800a236d2361d804e83ee0e95a481d39cd7c95f0
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/editing/execCommand/remove-format-variable-crash.html
@@ -0,0 +1,19 @@
+<script>
+document.documentElement.contentEditable="true"
+document.documentElement.appendChild(document.createElement('table'))
+eAcronym = document.createElement('acronym')
+document.documentElement.appendChild(eAcronym)
+document.documentElement.appendChild(document.createElement('keygen'))
+newElem = document.createElement('figure')
+newElem.style.cssText = '--AAAA: var(--BBBB)'
+document.documentElement.appendChild(newElem)
+eCite = document.createElement('cite')
+eCite.style.cssText = 'float: var(--CCCC)'
+eAcronym.appendChild(eCite)
+eCite.appendChild(document.createElement('marquee'));
+document.execCommand('SelectAll', 'false', 'true')
+document.execCommand('RemoveFormat', 'true', 'true')

[yosin_UTC9, 2016/06/29 05:11:41]

Could you put write HTML in the file rather than constructing by script?

[Timothy Loh, 2016/06/29 05:22:04]

I tried doing this sort of thing but it no longer reproduced the issue, and I
don't really know what's going on in the editing code to work out why. So I
ended up just leaving the code pretty much verbatim from the clusterfuzz case.

+window.testRunner && testRunner.dumpAsText();

[yosin_UTC9, 2016/06/29 05:11:42]

Could you use test w3c harness? Using |assert_selection()| is preferred in this
case.
Sample: crrev.com/396768

[Timothy Loh, 2016/06/29 05:22:04]

I'll try, but I might not be able to get it to repro with it.

[alancutter (OOO until 2018), 2016/06/29 07:26:10]

testharness.js is desirable. You may need to wait a frame with async_test() if
an empty test(() => {}) doesn't work.

[Timothy Loh, 2016/06/30 04:16:42]

I updated the test with a test(() => {}) call, seems to still work. I'm not
really sure how I should be using assert_selection() since I'm just checking
whether the page crashes.

+</script>
+
+This test passes if it doesn't crash.