Disallow setting invalid values for registered properties via CSSOM

third_party/WebKit/Source/core/animation/EffectInput.cpp

Index: third_party/WebKit/Source/core/animation/EffectInput.cpp
diff --git a/third_party/WebKit/Source/core/animation/EffectInput.cpp b/third_party/WebKit/Source/core/animation/EffectInput.cpp
index 5109041b294b815486a21a29bbbd20ef36b84e00..fca7e3a932cd78f135a31978bd3cfbd893c3d9af 100644
--- a/third_party/WebKit/Source/core/animation/EffectInput.cpp
+++ b/third_party/WebKit/Source/core/animation/EffectInput.cpp
@@ -95,8 +95,9 @@ void setKeyframeValue(Element& element,
   if (cssProperty != CSSPropertyInvalid) {
     MutableStylePropertySet::SetResult setResult =
         cssProperty == CSSPropertyVariable
-            ? keyframe.setCSSPropertyValue(AtomicString(property), value,
-                                           styleSheetContents)
+            ? keyframe.setCSSPropertyValue(
+                  AtomicString(property), element.document().propertyRegistry(),
+                  value, styleSheetContents)
             : keyframe.setCSSPropertyValue(cssProperty, value,
                                            styleSheetContents);
     if (!setResult.didParse && executionContext) {