Disallow setting invalid values for registered properties via CSSOM

third_party/WebKit/Source/core/css/parser/CSSParser.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSParser.h"
 
 #include "core/css/CSSColorValue.h"
 #include "core/css/CSSKeyframeRule.h"
 #include "core/css/StyleColor.h"
 #include "core/css/StyleRule.h"
@@ skipping 91 matching lines @@
     context = styleSheet->parserContext();
     context.setMode(parserMode);
   }
   return parseValue(declaration, unresolvedProperty, string, important,
                     context);
 }
 
 MutableStylePropertySet::SetResult CSSParser::parseValueForCustomProperty(
     MutableStylePropertySet* declaration,
     const AtomicString& propertyName,
+    const PropertyRegistry* registry,
     const String& value,
     bool important,
     StyleSheetContents* styleSheet,
     bool isAnimationTainted) {
   DCHECK(CSSVariableParser::isValidVariableName(propertyName));
   if (value.isEmpty()) {
     bool didParse = false;
     bool didChange = false;
     return MutableStylePropertySet::SetResult{didParse, didChange};
   }
   CSSParserMode parserMode = declaration->cssParserMode();
   CSSParserContext context(parserMode, nullptr);
   if (styleSheet) {
     context = styleSheet->parserContext();
     context.setMode(parserMode);
   }
-  return CSSParserImpl::parseVariableValue(
-      declaration, propertyName, value, important, context, isAnimationTainted);
+  return CSSParserImpl::parseVariableValue(declaration, propertyName, registry,
+                                           value, important, context,
+                                           isAnimationTainted);
 }
 
 ImmutableStylePropertySet* CSSParser::parseCustomPropertySet(
     CSSParserTokenRange range) {
   return CSSParserImpl::parseCustomPropertySet(range);
 }
 
 MutableStylePropertySet::SetResult CSSParser::parseValue(
     MutableStylePropertySet* declaration,
     CSSPropertyID unresolvedProperty,
@@ skipping 87 matching lines @@
   builder.append(propertyValue);
   builder.append("; }");
   StyleRuleBase* rule = parseRule(context, nullptr, builder.toString());
   if (!rule || !rule->isFontFaceRule())
     return nullptr;
   return toStyleRuleFontFace(rule)->properties().getPropertyCSSValue(
       propertyID);
 }
 
 }  // namespace blink