flex shorthand incorrectly accepting 1 0% 1 (i.e. flex-basis in the middle)

Source/core/css/parser/CSSPropertyParser.cpp

Index: Source/core/css/parser/CSSPropertyParser.cpp
diff --git a/Source/core/css/parser/CSSPropertyParser.cpp b/Source/core/css/parser/CSSPropertyParser.cpp
index b1c38e7488cb82bd9722c130f1a38c4aa51d2e05..42d88d991d5dd2235f2a25983e92f64d58f16ff7 100644
--- a/Source/core/css/parser/CSSPropertyParser.cpp
+++ b/Source/core/css/parser/CSSPropertyParser.cpp
@@ -5708,6 +5708,11 @@ bool CSSPropertyParser::parseReflect(CSSPropertyID propId, bool important)
     return true;
 }
 
+static bool isFlexBasisMiddleArg(double flexGrow, double flexShrink, double unsetValue, int argSize)
+{
+    return flexGrow != unsetValue && flexShrink == unsetValue &&  argSize == 3;
+}
+
 bool CSSPropertyParser::parseFlex(CSSParserValueList* args, bool important)
 {
     if (!args || !args->size() || args->size() > 3)
@@ -5730,7 +5735,7 @@ bool CSSPropertyParser::parseFlex(CSSParserValueList* args, bool important)
                 // We only allow 3 numbers without units if the last value is 0. E.g., flex:1 1 1 is invalid.
                 return false;
             }
-        } else if (!flexBasis && (arg->id == CSSValueAuto || validUnit(arg, FLength | FPercent | FNonNeg)))
+        } else if (!flexBasis && (arg->id == CSSValueAuto || (validUnit(arg, FLength | FPercent | FNonNeg) && !isFlexBasisMiddleArg(flexGrow, flexShrink, unsetValue, args->size()))))
             flexBasis = parseValidPrimitive(arg->id, arg);
         else {
             // Not a valid arg for flex.