[CSS Shapes] polygon y-value calc() args serialize incorrectly

Source/core/css/parser/CSSPropertyParser.cpp

 /*
  * Copyright (C) 2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
@@ skipping 4307 matching lines @@
         argument = args->next();
         size -= 2;
     }
 
     // <length> <length>, ... <length> <length> -> each pair has 3 elements except the last one
     if (!size || (size % 3) - 2)
         return nullptr;
 
     CSSParserValue* argumentX = argument;
     while (argumentX) {
+
         if (!validUnit(argumentX, FLength | FPercent))
             return nullptr;
+        RefPtrWillBeRawPtr<CSSPrimitiveValue> xLength = createPrimitiveNumericValue(argumentX);
 
         CSSParserValue* argumentY = args->next();
         if (!argumentY || !validUnit(argumentY, FLength | FPercent))
             return nullptr;
 
-        RefPtrWillBeRawPtr<CSSPrimitiveValue> xLength = createPrimitiveNumericValue(argumentX);
         RefPtrWillBeRawPtr<CSSPrimitiveValue> yLength = createPrimitiveNumericValue(argumentY);
 
         shape->appendPoint(xLength.release(), yLength.release());
 
         CSSParserValue* commaOrNull = args->next();
         if (!commaOrNull)
             argumentX = 0;
         else if (!isComma(commaOrNull))
             return nullptr;
         else
@@ skipping 4109 matching lines @@
         parsedValues->append(CSSPrimitiveValue::createIdentifier(CSSValueFill));
     if (!seenStroke)
         parsedValues->append(CSSPrimitiveValue::createIdentifier(CSSValueStroke));
     if (!seenMarkers)
         parsedValues->append(CSSPrimitiveValue::createIdentifier(CSSValueMarkers));
 
     return parsedValues.release();
 }
 
 } // namespace WebCore