Disallow CSS custom properties as descriptors

third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSParserImpl.h"
 
 #include "core/css/CSSCustomIdentValue.h"
 #include "core/css/CSSCustomPropertyDeclaration.h"
 #include "core/css/CSSKeyframesRule.h"
 #include "core/css/CSSStyleSheet.h"
@@ skipping 867 matching lines @@
       equalIgnoringASCIICase(last->value(), "important")) {
     --last;
     while (last->type() == WhitespaceToken)
       --last;
     if (last->type() == DelimiterToken && last->delimiter() == '!') {
       important = true;
       declarationValueEnd = last;
     }
   }
 
+  if (important &&
+      (ruleType == StyleRule::FontFace || ruleType == StyleRule::Keyframe))
+    return;
+
   size_t propertiesCount = m_parsedProperties.size();
-  // TODO(timloh): This should only be for StyleRule::Style/Keyframe,
-  // crbug.com/641873.
+
   if (unresolvedProperty == CSSPropertyVariable) {
+    if (ruleType != StyleRule::Style && ruleType != StyleRule::Keyframe)
+      return;
     AtomicString variableName = token.value().toAtomicString();
     bool isAnimationTainted = ruleType == StyleRule::Keyframe;
     consumeVariableValue(range.makeSubRange(&range.peek(), declarationValueEnd),
                          variableName, important, isAnimationTainted);
-  }
-
-  // TODO(timloh): Should this check occur before the call to
-  // consumeVariableValue()?
-  if (important &&
-      (ruleType == StyleRule::FontFace || ruleType == StyleRule::Keyframe))
-    return;
-
-  if (unresolvedProperty != CSSPropertyInvalid &&
-      unresolvedProperty != CSSPropertyVariable) {
+  } else if (unresolvedProperty != CSSPropertyInvalid) {
     if (m_styleSheet && m_styleSheet->singleOwnerDocument())
       Deprecation::warnOnDeprecatedProperties(
           m_styleSheet->singleOwnerDocument()->frame(), unresolvedProperty);
     consumeDeclarationValue(
         range.makeSubRange(&range.peek(), declarationValueEnd),
         unresolvedProperty, important, ruleType);
   }
 
   if (m_observerWrapper &&
       (ruleType == StyleRule::Style || ruleType == StyleRule::Keyframe)) {
@@ skipping 41 matching lines @@
     else
       return nullptr;  // Parser error, invalid value in keyframe selector
     if (range.atEnd())
       return result;
     if (range.consume().type() != CommaToken)
       return nullptr;  // Parser error
   }
 }
 
 }  // namespace blink