Disallow setting invalid values for registered properties via CSSOM

third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp

Index: third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp
diff --git a/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp b/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp
index 13c1cbdb9e22ac3f62d0301efcd3138549d45a62..7ce49a30a437fada7456cf9b19b86c126f46be4f 100644
--- a/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp
+++ b/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp
@@ -687,13 +687,17 @@ void ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline(
 
       // Mutate using the CSSOM wrapper so we get the same event behavior as a
       // script.
-      if (isEnclosingBlock(element))
-        element->style()->setPropertyInternal(
-            CSSPropertyDisplay, String(), "inline", false, IGNORE_EXCEPTION);
+      if (isEnclosingBlock(element)) {
+        element->style()->setPropertyInternal(CSSPropertyDisplay, String(),
+                                              "inline", false, nullptr,
+                                              IGNORE_EXCEPTION);
+      }
       if (element->layoutObject() &&
-          element->layoutObject()->style()->isFloating())
+          element->layoutObject()->style()->isFloating()) {
         element->style()->setPropertyInternal(CSSPropertyFloat, String(),
-                                              "none", false, IGNORE_EXCEPTION);
+                                              "none", false, nullptr,
+                                              IGNORE_EXCEPTION);
+      }
     }
   }
 }