flex shorthand incorrectly accepting 1 0% 1 (i.e. flex-basis in the middle)

Source/core/css/parser/CSSPropertyParser.cpp

Index: Source/core/css/parser/CSSPropertyParser.cpp
diff --git a/Source/core/css/parser/CSSPropertyParser.cpp b/Source/core/css/parser/CSSPropertyParser.cpp
index ad787dec40fc511232af9a366bee5f9218563ac9..505641487c428968998c6e1a750fcb3608598e2b 100644
--- a/Source/core/css/parser/CSSPropertyParser.cpp
+++ b/Source/core/css/parser/CSSPropertyParser.cpp
@@ -5730,7 +5730,7 @@ bool CSSPropertyParser::parseFlex(CSSParserValueList* args, bool important)
                 // We only allow 3 numbers without units if the last value is 0. E.g., flex:1 1 1 is invalid.
                 return false;
             }
-        } else if (!flexBasis && (arg->id == CSSValueAuto || validUnit(arg, FLength | FPercent | FNonNeg)))
+        } else if (!flexBasis && (arg->id == CSSValueAuto || (validUnit(arg, FLength | FPercent | FNonNeg) && !(flexGrow != unsetValue && flexShrink == unsetValue && args->size() == 3))))

[tony, 2014/07/16 17:12:38]

I would make a helper function for this to help document what this check is. 
Something like isFlexBasisMiddleArg.

[harpreet.sk, 2014/07/17 08:03:25]

Done.

             flexBasis = parseValidPrimitive(arg->id, arg);
         else {
             // Not a valid arg for flex.