Perspective property should only allow positive lengths

Source/core/css/parser/CSSPropertyParser.cpp

 /*
  * Copyright (C) 2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
@@ skipping 1133 matching lines @@
     case CSSPropertyWebkitPerspectiveOriginY:
     case CSSPropertyWebkitTransformOriginY:
         parsedValue = parseFillPositionY(m_valueList);
         if (parsedValue)
             m_valueList->next();
         break;
     case CSSPropertyWebkitTransformOriginZ:
         validPrimitive = validUnit(value, FLength);
         break;
     case CSSPropertyPerspective:
-        if (id == CSSValueNone) {
+        if (id == CSSValueNone)
             validPrimitive = true;
-        } else if (validUnit(value, FLength | FNonNeg)) {
-            addProperty(propId, createPrimitiveNumericValue(value), important);
-            return true;
-        }
+        else if (validUnit(value, FLength) && (m_parsedCalculation || value->fValue > 0))
+            validPrimitive = true;
+        else
+            return false;
         break;
     case CSSPropertyWebkitPerspective:
-        if (id == CSSValueNone) {
+        if (id == CSSValueNone)
             validPrimitive = true;
-        } else if (validUnit(value, FNumber | FLength | FNonNeg)) {
-            // Accepting valueless numbers is a quirk of the -webkit prefixed version of the property.
-            addProperty(propId, createPrimitiveNumericValue(value), important);
-            return true;
-        }
+        else if (validUnit(value, FNumber | FLength) && (m_parsedCalculation || value->fValue > 0))
+            validPrimitive = true;
+        else
+            return false;
         break;
     case CSSPropertyPerspectiveOrigin:
     case CSSPropertyWebkitPerspectiveOrigin: {
         RefPtrWillBeRawPtr<CSSValueList> list = parseTransformOrigin();
         if (!list || list->length() == 3)
             return false;
         // This values are added to match gecko serialization.
         if (list->length() == 1)
             list->append(cssValuePool().createValue(50, CSSPrimitiveValue::CSS_PERCENTAGE));
         addProperty(propId, list.release(), important);
@@ skipping 7312 matching lines @@
         }
     }
 
     if (!list->length())
         return nullptr;
 
     return list.release();
 }
 
 } // namespace blink