Perspective property should only allow positive lengths

Source/core/css/parser/CSSPropertyParser.cpp

 /*
  * Copyright (C) 2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
@@ skipping 1136 matching lines @@
         if (parsedValue)
             m_valueList->next();
         break;
     case CSSPropertyWebkitTransformOriginZ:
         validPrimitive = validUnit(value, FLength);
         break;
     case CSSPropertyPerspective:
         if (id == CSSValueNone) {
             validPrimitive = true;
         } else if (validUnit(value, FLength | FNonNeg)) {
-            addProperty(propId, createPrimitiveNumericValue(value), important);
-            return true;
+            if (m_parsedCalculation ? m_parsedCalculation->isPositive() : value->fValue > 0) {
+                addProperty(propId, createPrimitiveNumericValue(value), important);
+                return true;
+            }
+            return false;
         }
         break;
     case CSSPropertyWebkitPerspective:
         if (id == CSSValueNone) {
             validPrimitive = true;
         } else if (validUnit(value, FNumber | FLength | FNonNeg)) {
-            // Accepting valueless numbers is a quirk of the -webkit prefixed version of the property.
-            addProperty(propId, createPrimitiveNumericValue(value), important);
-            return true;
+            if (m_parsedCalculation ? m_parsedCalculation->isPositive() : value->fValue > 0) {
+                // Accepting valueless numbers is a quirk of the -webkit prefixed version of the property.
+                addProperty(propId, createPrimitiveNumericValue(value), important);
+                return true;
+            }
+            return false;
         }
         break;
     case CSSPropertyPerspectiveOrigin:
     case CSSPropertyWebkitPerspectiveOrigin: {
         RefPtrWillBeRawPtr<CSSValueList> list = parseTransformOrigin();
         if (!list || list->length() == 3)
             return false;
         // This values are added to match gecko serialization.
         if (list->length() == 1)
             list->append(cssValuePool().createValue(50, CSSPrimitiveValue::CSS_PERCENTAGE));
@@ skipping 7319 matching lines @@
         }
     }
 
     if (!list->length())
         return nullptr;
 
     return list.release();
 }
 
 } // namespace blink