Perspective property should only allow positive lengths

Source/core/css/CSSCalculationValue.h

 /*
  * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 101 matching lines @@
     PassRefPtr<CalculationValue> toCalcValue(const CSSToLengthConversionData& conversionData) const
     {
         PixelsAndPercent value(0, 0);
         m_expression->accumulatePixelsAndPercent(conversionData, value);
         return CalculationValue::create(value, m_nonNegative ? ValueRangeNonNegative : ValueRangeAll);
     }
     CalculationCategory category() const { return m_expression->category(); }
     bool isInt() const { return m_expression->isInteger(); }
     double doubleValue() const;
     bool isNegative() const { return m_expression->doubleValue() < 0; }
+    bool isPositive() const { return m_expression->doubleValue() > 0; }

[alancutter (OOO until 2018), 2015/03/12 03:43:08]

The doubleValue() function is broken for lengths and should probably
ASSERT_NOT_REACHED() in these cases.

The calc spec defers clamping of the value until a final value can be produced:
http://dev.w3.org/csswg/css-values-3/#calc-range

We should just allow calcs in the parser and clamp appropriately in
convertPerspectiveLength().
At the moment it clamps to >= 0 which seems incorrect for perspective. Instead
we should probably clamp to a small value like 1e-8 otherwise we treat 0 as none
which is an implementation detail rather than spec described behaviour.

     ValueRange permittedValueRange() { return m_nonNegative ? ValueRangeNonNegative : ValueRangeAll; }
     double computeLengthPx(const CSSToLengthConversionData&) const;
     void accumulateLengthArray(CSSLengthArray& lengthArray, CSSLengthTypeArray& lengthTypeArray, double multiplier) const { m_expression->accumulateLengthArray(lengthArray, lengthTypeArray, multiplier); }
     CSSCalcExpressionNode* expressionNode() const { return m_expression.get(); }
 
     String customCSSText() const;
     bool equals(const CSSCalcValue&) const;
 
     DECLARE_TRACE_AFTER_DISPATCH();
 
@@ skipping 10 matching lines @@
     const RefPtrWillBeMember<CSSCalcExpressionNode> m_expression;
     const bool m_nonNegative;
 };
 
 DEFINE_CSS_VALUE_TYPE_CASTS(CSSCalcValue, isCalcValue());
 
 } // namespace blink
 
 
 #endif // CSSCalculationValue_h