Disallow CSS custom properties as descriptors

third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp

Index: third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp
diff --git a/third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp b/third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp
index 4365e067fcbb73ab049bc8e70604f4801774ec67..3aa4f2674f3e6bda94399cec8e98abda17856776 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp
@@ -885,24 +885,20 @@ void CSSParserImpl::consumeDeclaration(CSSParserTokenRange range,
     }
   }
 
+  if (important &&
+      (ruleType == StyleRule::FontFace || ruleType == StyleRule::Keyframe))
+    return;
+
   size_t propertiesCount = m_parsedProperties.size();
-  // TODO(timloh): This should only be for StyleRule::Style/Keyframe,
-  // crbug.com/641873.
+
   if (unresolvedProperty == CSSPropertyVariable) {
+    if (ruleType != StyleRule::Style && ruleType != StyleRule::Keyframe)
+      return;
     AtomicString variableName = token.value().toAtomicString();
     bool isAnimationTainted = ruleType == StyleRule::Keyframe;
     consumeVariableValue(range.makeSubRange(&range.peek(), declarationValueEnd),
                          variableName, important, isAnimationTainted);
-  }
-
-  // TODO(timloh): Should this check occur before the call to
-  // consumeVariableValue()?
-  if (important &&
-      (ruleType == StyleRule::FontFace || ruleType == StyleRule::Keyframe))
-    return;
-
-  if (unresolvedProperty != CSSPropertyInvalid &&
-      unresolvedProperty != CSSPropertyVariable) {
+  } else if (unresolvedProperty != CSSPropertyInvalid) {
     if (m_styleSheet && m_styleSheet->singleOwnerDocument())
       Deprecation::warnOnDeprecatedProperties(
           m_styleSheet->singleOwnerDocument()->frame(), unresolvedProperty);