Implement animation tainted custom property values

third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSParserImpl.h"
 
 #include "core/css/CSSCustomIdentValue.h"
 #include "core/css/CSSCustomPropertyDeclaration.h"
 #include "core/css/CSSKeyframesRule.h"
 #include "core/css/CSSStyleSheet.h"
@@ skipping 43 matching lines @@
                                  important, ruleType);
   if (parser.m_parsedProperties.isEmpty())
     return false;
   return declaration->addParsedProperties(parser.m_parsedProperties);
 }
 
 bool CSSParserImpl::parseVariableValue(MutableStylePropertySet* declaration,
                                        const AtomicString& propertyName,
                                        const String& value,
                                        bool important,
-                                       const CSSParserContext& context) {
+                                       const CSSParserContext& context,
+                                       bool isAnimationTainted) {
   CSSParserImpl parser(context);
   CSSTokenizer::Scope scope(value);
-  parser.consumeVariableValue(scope.tokenRange(), propertyName, important);
+  parser.consumeVariableValue(scope.tokenRange(), propertyName, important,
+                              isAnimationTainted);
   if (parser.m_parsedProperties.isEmpty())
     return false;
   return declaration->addParsedProperties(parser.m_parsedProperties);
 }
 
 static inline void filterProperties(
     bool important,
     const HeapVector<CSSProperty, 256>& input,
     HeapVector<CSSProperty, 256>& output,
     size_t& unusedEntries,
@@ skipping 769 matching lines @@
     --last;
     while (last->type() == WhitespaceToken)
       --last;
     if (last->type() == DelimiterToken && last->delimiter() == '!') {
       important = true;
       declarationValueEnd = last;
     }
   }
 
   size_t propertiesCount = m_parsedProperties.size();
-  // TODO(timloh): This only be for StyleRule::Style, crbug.com/641873.
+  // TODO(timloh): This should only be for StyleRule::Style/Keyframe, crbug.com/641873.
   if (unresolvedProperty == CSSPropertyVariable) {
     AtomicString variableName = token.value().toAtomicString();
+    bool isAnimationTainted = ruleType == StyleRule::Keyframe;
     consumeVariableValue(range.makeSubRange(&range.peek(), declarationValueEnd),
-                         variableName, important);
+                         variableName, important, isAnimationTainted);
   }
 
+  // TODO(timloh): Should this check occur before the call to consumeVariableValue()?
   if (important &&
       (ruleType == StyleRule::FontFace || ruleType == StyleRule::Keyframe))
     return;
 
   if (unresolvedProperty != CSSPropertyInvalid &&
       unresolvedProperty != CSSPropertyVariable) {
     if (m_styleSheet && m_styleSheet->singleOwnerDocument())
       Deprecation::warnOnDeprecatedProperties(
           m_styleSheet->singleOwnerDocument()->frame(), unresolvedProperty);
     consumeDeclarationValue(
         range.makeSubRange(&range.peek(), declarationValueEnd),
         unresolvedProperty, important, ruleType);
   }
 
   if (m_observerWrapper &&
       (ruleType == StyleRule::Style || ruleType == StyleRule::Keyframe)) {
     m_observerWrapper->observer().observeProperty(
         m_observerWrapper->startOffset(rangeCopy),
         m_observerWrapper->endOffset(rangeCopy), important,
         m_parsedProperties.size() != propertiesCount);
   }
 }
 
 void CSSParserImpl::consumeVariableValue(CSSParserTokenRange range,
                                          const AtomicString& variableName,
-                                         bool important) {
+                                         bool important,
+                                         bool isAnimationTainted) {
   if (CSSCustomPropertyDeclaration* value =
-          CSSVariableParser::parseDeclarationValue(variableName, range))
+          CSSVariableParser::parseDeclarationValue(variableName, range,
+                                                   isAnimationTainted))
     m_parsedProperties.append(
         CSSProperty(CSSPropertyVariable, *value, important));
 }
 
 void CSSParserImpl::consumeDeclarationValue(CSSParserTokenRange range,
                                             CSSPropertyID unresolvedProperty,
                                             bool important,
                                             StyleRule::RuleType ruleType) {
   CSSPropertyParser::parseValue(unresolvedProperty, important, range, m_context,
                                 m_parsedProperties, ruleType);
@@ skipping 17 matching lines @@
     else
       return nullptr;  // Parser error, invalid value in keyframe selector
     if (range.atEnd())
       return result;
     if (range.consume().type() != CommaToken)
       return nullptr;  // Parser error
   }
 }
 
 }  // namespace blink