Implement animation tainted custom property values

third_party/WebKit/Source/core/animation/css/CSSAnimations.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 95 matching lines @@
         if (value.isInheritedValue() && parentStyle->animations()) {
           timingFunction = parentStyle->animations()->timingFunctionList()[0];
         } else if (value.isValueList()) {
           timingFunction = CSSToStyleMap::mapAnimationTimingFunction(
               toCSSValueList(value).item(0));
         } else {
           DCHECK(value.isCSSWideKeyword());
           timingFunction = CSSTimingData::initialTimingFunction();
         }
         keyframe->setEasing(timingFunction.release());
-      } else if (CSSAnimations::isAnimatableProperty(property)) {
+      } else if (!CSSAnimations::isAnimationAffectingProperty(property)) {
         keyframe->setCSSPropertyValue(property,
                                       properties.propertyAt(j).value());
       }
     }
     keyframes.append(keyframe);
     // The last keyframe specified at a given offset is used.
     for (size_t j = 1; j < offsets.size(); ++j) {
       keyframes.append(
           toStringKeyframe(keyframe->cloneWithOffset(offsets[j]).get()));
     }
@@ skipping 914 matching lines @@
         properties.append(id);
     }
     propertyShorthand = StylePropertyShorthand(
         CSSPropertyInvalid, properties.begin(), properties.size());
   }
   return propertyShorthand;
 }
 
 // Properties that affect animations are not allowed to be affected by
 // animations. http://w3c.github.io/web-animations/#not-animatable-section
-bool CSSAnimations::isAnimatableProperty(CSSPropertyID property) {
+bool CSSAnimations::isAnimationAffectingProperty(CSSPropertyID property) {
   switch (property) {
     case CSSPropertyAnimation:
     case CSSPropertyAnimationDelay:
     case CSSPropertyAnimationDirection:
     case CSSPropertyAnimationDuration:
     case CSSPropertyAnimationFillMode:
     case CSSPropertyAnimationIterationCount:
     case CSSPropertyAnimationName:
     case CSSPropertyAnimationPlayState:
     case CSSPropertyAnimationTimingFunction:
     case CSSPropertyDisplay:
     case CSSPropertyTransition:
     case CSSPropertyTransitionDelay:
     case CSSPropertyTransitionDuration:
     case CSSPropertyTransitionProperty:
     case CSSPropertyTransitionTimingFunction:
+      return true;
+    default:
       return false;
-    default:
-      return true;
   }
 }
 
 bool CSSAnimations::isAffectedByKeyframesFromScope(const Element& element,
                                                    const TreeScope& treeScope) {
   // Animated elements are affected by @keyframes rules from the same scope
   // and from their shadow sub-trees if they are shadow hosts.
   if (element.treeScope() == treeScope)
     return true;
   if (!isShadowHost(element))
     return false;
   if (treeScope.rootNode() == treeScope.document())
     return false;
   return toShadowRoot(treeScope.rootNode()).host() == element;
 }
 
 DEFINE_TRACE(CSSAnimations) {
   visitor->trace(m_transitions);
   visitor->trace(m_pendingUpdate);
   visitor->trace(m_runningAnimations);
 }
 
 }  // namespace blink