Disallow setting invalid values for registered properties via CSSOM

third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp

Index: third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp
diff --git a/third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp b/third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp
index 1e64f1bbfc91261df6d5dbdfe0ec9806ad21faee..56c252edc71bf0f05bcb6bc5fd9340c87efd9e6d 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp
@@ -8,6 +8,7 @@
 #include "core/css/CSSCustomPropertyDeclaration.h"
 #include "core/css/CSSKeyframesRule.h"
 #include "core/css/CSSStyleSheet.h"
+#include "core/css/PropertyRegistry.h"
 #include "core/css/StyleRuleImport.h"
 #include "core/css/StyleRuleKeyframe.h"
 #include "core/css/StyleRuleNamespace.h"
@@ -68,6 +69,7 @@ MutableStylePropertySet::SetResult CSSParserImpl::parseValue(
 MutableStylePropertySet::SetResult CSSParserImpl::parseVariableValue(
     MutableStylePropertySet* declaration,
     const AtomicString& propertyName,
+    const PropertyRegistry* registry,
     const String& value,
     bool important,
     const CSSParserContext& context,
@@ -79,6 +81,17 @@ MutableStylePropertySet::SetResult CSSParserImpl::parseVariableValue(
   bool didParse = false;
   bool didChange = false;
   if (!parser.m_parsedProperties.isEmpty()) {
+    if (registry) {
+      const PropertyRegistry::Registration* registration =
+          registry->registration(propertyName);
+      // TODO(timloh): This is a bit wasteful, we parse the registered property
+      // to validate but throw away the result.
+      if (registration &&
+          !registration->syntax().parse(tokenizer.tokenRange(),
+                                        isAnimationTainted)) {
+        return MutableStylePropertySet::SetResult{didParse, didChange};
+      }
+    }
     didParse = true;
     didChange = declaration->addParsedProperties(parser.m_parsedProperties);
   }