Disallow setting invalid values for registered properties via CSSOM

third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp

 /*
  * Copyright (C) 2005, 2006, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2009, 2010, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 669 matching lines @@
       // There are other styles that style rules can give to style spans, but
       // these are the two important ones because they'll prevent inserted
       // content from appearing in the right paragraph.
       // FIXME: Hyatt is concerned that selectively using display:inline will
       // give inconsistent results. We already know one issue because td
       // elements ignore their display property in quirks mode (which Mail.app
       // is always in). We should look for an alternative.
 
       // Mutate using the CSSOM wrapper so we get the same event behavior as a
       // script.
-      if (isEnclosingBlock(element))
-        element->style()->setPropertyInternal(
-            CSSPropertyDisplay, String(), "inline", false, IGNORE_EXCEPTION);
+      if (isEnclosingBlock(element)) {
+        element->style()->setPropertyInternal(CSSPropertyDisplay, String(),
+                                              "inline", false, nullptr,
+                                              IGNORE_EXCEPTION);
+      }
       if (element->layoutObject() &&
-          element->layoutObject()->style()->isFloating())
+          element->layoutObject()->style()->isFloating()) {
         element->style()->setPropertyInternal(CSSPropertyFloat, String(),
-                                              "none", false, IGNORE_EXCEPTION);
+                                              "none", false, nullptr,
+                                              IGNORE_EXCEPTION);
+      }
     }
   }
 }
 
 static bool isProhibitedParagraphChild(const AtomicString& name) {
   // https://dvcs.w3.org/hg/editing/raw-file/57abe6d3cb60/editing.html#prohibited-paragraph-child
   DEFINE_STATIC_LOCAL(HashSet<AtomicString>, elements,
                       ({
                           addressTag.localName(),   articleTag.localName(),
                           asideTag.localName(),     blockquoteTag.localName(),
@@ skipping 1423 matching lines @@
   visitor->trace(m_startOfInsertedContent);
   visitor->trace(m_endOfInsertedContent);
   visitor->trace(m_insertionStyle);
   visitor->trace(m_documentFragment);
   visitor->trace(m_startOfInsertedRange);
   visitor->trace(m_endOfInsertedRange);
   CompositeEditCommand::trace(visitor);
 }
 
 }  // namespace blink