Disallow setting invalid values for registered properties via CSSOM

third_party/WebKit/Source/core/animation/EffectInput.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 77 matching lines @@
                       const String& value,
                       ExecutionContext* executionContext) {
   StyleSheetContents* styleSheetContents =
       element.document().elementSheet().contents();
   CSSPropertyID cssProperty =
       AnimationInputHelpers::keyframeAttributeToCSSProperty(property,
                                                             element.document());
   if (cssProperty != CSSPropertyInvalid) {
     MutableStylePropertySet::SetResult setResult =
         cssProperty == CSSPropertyVariable
-            ? keyframe.setCSSPropertyValue(AtomicString(property), value,
-                                           styleSheetContents)
+            ? keyframe.setCSSPropertyValue(
+                  AtomicString(property), element.document().propertyRegistry(),
+                  value, styleSheetContents)
             : keyframe.setCSSPropertyValue(cssProperty, value,
                                            styleSheetContents);
     if (!setResult.didParse && executionContext) {
       Document& document = toDocument(*executionContext);
       if (document.frame()) {
         document.frame()->console().addMessage(ConsoleMessage::create(
             JSMessageSource, WarningMessageLevel,
             "Invalid keyframe value for property " + property + ": " + value));
       }
     }
@@ skipping 274 matching lines @@
   }
 
   std::sort(keyframes.begin(), keyframes.end(), compareKeyframes);
 
   DCHECK(!exceptionState.hadException());
 
   return createEffectModelFromKeyframes(element, keyframes, exceptionState);
 }
 
 }  // namespace blink