Disallow setting invalid values for registered properties via CSSOM

third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp

Index: third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp
diff --git a/third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp b/third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp
index 1e64f1bbfc91261df6d5dbdfe0ec9806ad21faee..90ef6d6ad97718c653fe5ab887f0ab4d55ce7997 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp
@@ -8,6 +8,7 @@
 #include "core/css/CSSCustomPropertyDeclaration.h"
 #include "core/css/CSSKeyframesRule.h"
 #include "core/css/CSSStyleSheet.h"
+#include "core/css/PropertyRegistry.h"
 #include "core/css/StyleRuleImport.h"
 #include "core/css/StyleRuleKeyframe.h"
 #include "core/css/StyleRuleNamespace.h"
@@ -68,6 +69,7 @@ MutableStylePropertySet::SetResult CSSParserImpl::parseValue(
 MutableStylePropertySet::SetResult CSSParserImpl::parseVariableValue(
     MutableStylePropertySet* declaration,
     const AtomicString& propertyName,
+    const PropertyRegistry* registry,
     const String& value,
     bool important,
     const CSSParserContext& context,
@@ -79,6 +81,16 @@ MutableStylePropertySet::SetResult CSSParserImpl::parseVariableValue(
   bool didParse = false;
   bool didChange = false;
   if (!parser.m_parsedProperties.isEmpty()) {
+    if (registry) {
+      const PropertyRegistry::Registration* registration =
+          registry->registration(propertyName);
+      // TODO(timloh): This is a bit wasteful, we parse the registered property
+      // to validate but throw away the result.

[alancutter (OOO until 2018), 2017/01/04 01:03:42]

General comment: A CSSValue cache (with a void* to the registry to invalidate
against) on CSSVariableData would probably be the solution here.

+      if (registration &&
+          !registration->syntax().parse(tokenizer.tokenRange(),
+                                        isAnimationTainted))
+        return MutableStylePropertySet::SetResult{didParse, didChange};

[alancutter (OOO until 2018), 2017/01/04 01:03:42]

Use braces here.

[Timothy Loh, 2017/01/04 02:00:59]

sure

+    }
     didParse = true;
     didChange = declaration->addParsedProperties(parser.m_parsedProperties);
   }