Implement animation tainted custom property values

third_party/WebKit/Source/core/css/resolver/CSSVariableResolver.cpp

Index: third_party/WebKit/Source/core/css/resolver/CSSVariableResolver.cpp
diff --git a/third_party/WebKit/Source/core/css/resolver/CSSVariableResolver.cpp b/third_party/WebKit/Source/core/css/resolver/CSSVariableResolver.cpp
index 151ba4acd2115e0030a34d97b088a5c5917f82bc..08aab457152cbb5ee33af2f311ab1645411fb16a 100644
--- a/third_party/WebKit/Source/core/css/resolver/CSSVariableResolver.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/CSSVariableResolver.cpp
@@ -26,12 +26,15 @@
 namespace blink {
 
 bool CSSVariableResolver::resolveFallback(CSSParserTokenRange range,
-                                          Vector<CSSParserToken>& result) {
+                                          bool disallowAnimationTainted,
+                                          Vector<CSSParserToken>& result,
+                                          bool& resultIsAnimationTainted) {
   if (range.atEnd())
     return false;
   ASSERT(range.peek().type() == CommaToken);
   range.consume();
-  return resolveTokenRange(range, result);
+  return resolveTokenRange(range, disallowAnimationTainted, result,
+                           resultIsAnimationTainted);
 }
 
 CSSVariableData* CSSVariableResolver::valueForCustomProperty(
@@ -90,9 +93,13 @@ PassRefPtr<CSSVariableData> CSSVariableResolver::resolveCustomProperty(
     const CSSVariableData& variableData) {
   ASSERT(variableData.needsVariableResolution());
 
+  bool disallowAnimationTainted = false;
+  bool isAnimationTainted = variableData.isAnimationTainted();
   Vector<CSSParserToken> tokens;
   m_variablesSeen.add(name);
-  bool success = resolveTokenRange(variableData.tokens(), tokens);
+  bool success =
+      resolveTokenRange(variableData.tokens(), disallowAnimationTainted, tokens,
+                        isAnimationTainted);
   m_variablesSeen.remove(name);
 
   // The old variable data holds onto the backing string the new resolved
@@ -104,12 +111,15 @@ PassRefPtr<CSSVariableData> CSSVariableResolver::resolveCustomProperty(
     m_cycleStartPoints.remove(name);
     return nullptr;
   }
-  return CSSVariableData::createResolved(tokens, variableData);
+  return CSSVariableData::createResolved(tokens, variableData,
+                                         isAnimationTainted);
 }
 
 bool CSSVariableResolver::resolveVariableReference(
     CSSParserTokenRange range,
-    Vector<CSSParserToken>& result) {
+    bool disallowAnimationTainted,
+    Vector<CSSParserToken>& result,
+    bool& resultIsAnimationTainted) {
   range.consumeWhitespace();
   ASSERT(range.peek().type() == IdentToken);
   AtomicString variableName =
@@ -117,12 +127,21 @@ bool CSSVariableResolver::resolveVariableReference(
   ASSERT(range.atEnd() || (range.peek().type() == CommaToken));
 
   CSSVariableData* variableData = valueForCustomProperty(variableName);
-  if (!variableData)
-    return resolveFallback(range, result);
+  if (!variableData ||
+      (disallowAnimationTainted && variableData->isAnimationTainted())) {
+    // TODO(alancutter): Append the registered initial custom property value if
+    // we are disallowing an animation tainted value.
+    return resolveFallback(range, disallowAnimationTainted, result,
+                           resultIsAnimationTainted);
+  }
 
   result.appendVector(variableData->tokens());
+  resultIsAnimationTainted |= variableData->isAnimationTainted();
+
   Vector<CSSParserToken> trash;
-  resolveFallback(range, trash);
+  bool trashIsAnimationTainted;
+  resolveFallback(range, disallowAnimationTainted, trash,
+                  trashIsAnimationTainted);
   return true;
 }
 
@@ -154,11 +173,15 @@ void CSSVariableResolver::resolveApplyAtRule(CSSParserTokenRange& range,
 }
 
 bool CSSVariableResolver::resolveTokenRange(CSSParserTokenRange range,
-                                            Vector<CSSParserToken>& result) {
+                                            bool disallowAnimationTainted,
+                                            Vector<CSSParserToken>& result,
+                                            bool& resultIsAnimationTainted) {
   bool success = true;
   while (!range.atEnd()) {
     if (range.peek().functionId() == CSSValueVar) {
-      success &= resolveVariableReference(range.consumeBlock(), result);
+      success &= resolveVariableReference(range.consumeBlock(),
+                                          disallowAnimationTainted, result,
+                                          resultIsAnimationTainted);
     } else if (range.peek().type() == AtKeywordToken &&
                equalIgnoringASCIICase(range.peek().value(), "apply") &&
                RuntimeEnabledFeatures::cssApplyAtRulesEnabled()) {
@@ -173,16 +196,21 @@ bool CSSVariableResolver::resolveTokenRange(CSSParserTokenRange range,
 const CSSValue* CSSVariableResolver::resolveVariableReferences(
     const StyleResolverState& state,
     CSSPropertyID id,
-    const CSSValue& value) {
+    const CSSValue& value,
+    bool disallowAnimationTainted) {
   ASSERT(!isShorthandProperty(id));
 
-  if (value.isPendingSubstitutionValue())
+  if (value.isPendingSubstitutionValue()) {
     return resolvePendingSubstitutions(state, id,
-                                       toCSSPendingSubstitutionValue(value));
+                                       toCSSPendingSubstitutionValue(value),
+                                       disallowAnimationTainted);
+  }
 
-  if (value.isVariableReferenceValue())
+  if (value.isVariableReferenceValue()) {
     return resolveVariableReferences(state, id,
-                                     toCSSVariableReferenceValue(value));
+                                     toCSSVariableReferenceValue(value),
+                                     disallowAnimationTainted);
+  }
 
   NOTREACHED();
   return nullptr;
@@ -191,10 +219,14 @@ const CSSValue* CSSVariableResolver::resolveVariableReferences(
 const CSSValue* CSSVariableResolver::resolveVariableReferences(
     const StyleResolverState& state,
     CSSPropertyID id,
-    const CSSVariableReferenceValue& value) {
+    const CSSVariableReferenceValue& value,
+    bool disallowAnimationTainted) {
   CSSVariableResolver resolver(state);
   Vector<CSSParserToken> tokens;
-  if (!resolver.resolveTokenRange(value.variableDataValue()->tokens(), tokens))
+  bool isAnimationTainted = false;
+  if (!resolver.resolveTokenRange(value.variableDataValue()->tokens(),
+                                  disallowAnimationTainted, tokens,
+                                  isAnimationTainted))
     return CSSUnsetValue::create();
   const CSSValue* result =
       CSSPropertyParser::parseSingleValue(id, tokens, strictCSSParserContext());
@@ -206,7 +238,8 @@ const CSSValue* CSSVariableResolver::resolveVariableReferences(
 const CSSValue* CSSVariableResolver::resolvePendingSubstitutions(
     const StyleResolverState& state,
     CSSPropertyID id,
-    const CSSPendingSubstitutionValue& pendingValue) {
+    const CSSPendingSubstitutionValue& pendingValue,
+    bool disallowAnimationTainted) {
   // Longhands from shorthand references follow this path.
   HeapHashMap<CSSPropertyID, Member<const CSSValue>>& propertyCache =
       state.parsedPropertiesForPendingSubstitutionCache(pendingValue);
@@ -221,8 +254,10 @@ const CSSValue* CSSVariableResolver::resolvePendingSubstitutions(
     CSSVariableResolver resolver(state);
 
     Vector<CSSParserToken> tokens;
+    bool isAnimationTainted = false;
     if (resolver.resolveTokenRange(
-            shorthandValue->variableDataValue()->tokens(), tokens)) {
+            shorthandValue->variableDataValue()->tokens(),
+            disallowAnimationTainted, tokens, isAnimationTainted)) {
       CSSParserContext context(HTMLStandardMode, 0);
 
       HeapVector<CSSProperty, 256> parsedProperties;