flex shorthand incorrectly accepting 1 0% 1 (i.e. flex-basis in the middle)

Source/core/css/parser/CSSPropertyParser.cpp

 /*
  * Copyright (C) 2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
@@ skipping 5690 matching lines @@
         if (!mask)
             return false;
     }
 
     RefPtrWillBeRawPtr<CSSReflectValue> reflectValue = CSSReflectValue::create(direction.release(), offset.release(), mask.release());
     addProperty(propId, reflectValue.release(), important);
     m_valueList->next();
     return true;
 }
 
+static bool isFlexBasisMiddleArg(double flexGrow, double flexShrink, double unsetValue, int argSize)
+{
+    return flexGrow != unsetValue && flexShrink == unsetValue &&  argSize == 3;
+}
+
 bool CSSPropertyParser::parseFlex(CSSParserValueList* args, bool important)
 {
     if (!args || !args->size() || args->size() > 3)
         return false;
     static const double unsetValue = -1;
     double flexGrow = unsetValue;
     double flexShrink = unsetValue;
     RefPtrWillBeRawPtr<CSSPrimitiveValue> flexBasis = nullptr;
 
     while (CSSParserValue* arg = args->current()) {
         if (validUnit(arg, FNumber | FNonNeg)) {
             if (flexGrow == unsetValue)
                 flexGrow = arg->fValue;
             else if (flexShrink == unsetValue)
                 flexShrink = arg->fValue;
             else if (!arg->fValue) {
                 // flex only allows a basis of 0 (sans units) if flex-grow and flex-shrink values have already been set.
                 flexBasis = cssValuePool().createValue(0, CSSPrimitiveValue::CSS_PX);
             } else {
                 // We only allow 3 numbers without units if the last value is 0. E.g., flex:1 1 1 is invalid.
                 return false;
             }
-        } else if (!flexBasis && (arg->id == CSSValueAuto || validUnit(arg, FLength | FPercent | FNonNeg)))
+        } else if (!flexBasis && (arg->id == CSSValueAuto || (validUnit(arg, FLength | FPercent | FNonNeg) && !isFlexBasisMiddleArg(flexGrow, flexShrink, unsetValue, args->size()))))
             flexBasis = parseValidPrimitive(arg->id, arg);
         else {
             // Not a valid arg for flex.
             return false;
         }
         args->next();
     }
 
     if (flexGrow == unsetValue)
         flexGrow = 1;
@@ skipping 2753 matching lines @@
         parsedValues->append(CSSPrimitiveValue::createIdentifier(CSSValueFill));
     if (!seenStroke)
         parsedValues->append(CSSPrimitiveValue::createIdentifier(CSSValueStroke));
     if (!seenMarkers)
         parsedValues->append(CSSPrimitiveValue::createIdentifier(CSSValueMarkers));
 
     return parsedValues.release();
 }
 
 } // namespace WebCore