Perspective property should only allow positive lengths

Source/core/css/parser/CSSPropertyParser.cpp

 /*
  * Copyright (C) 2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
@@ skipping 1135 matching lines @@
         parsedValue = parseFillPositionY(m_valueList);
         if (parsedValue)
             m_valueList->next();
         break;
     case CSSPropertyWebkitTransformOriginZ:
         validPrimitive = validUnit(value, FLength);
         break;
     case CSSPropertyPerspective:
         if (id == CSSValueNone) {
             validPrimitive = true;
-        } else if (validUnit(value, FLength | FNonNeg)) {
-            addProperty(propId, createPrimitiveNumericValue(value), important);
-            return true;
+        } else {
+            bool isCalculationValue = isCalculation(value);
+            if (validUnit(value, FLength)) {
+                if (isCalculationValue || value->fValue > 0) {
+                    addProperty(propId, createPrimitiveNumericValue(value), important);
+                    return true;
+                }
+            }

[alancutter (OOO until 2018), 2015/03/16 23:33:15]

This can probably be simplified as:
if (id == CSSValueNone)
    validPrimitive = true;
else if (validUnit(value, FLength) && (m_parsedCalculation || value->fValue >
0))
    validPrimitive = true;
else
    return false;

Similarly below.

         }
         break;
     case CSSPropertyWebkitPerspective:
         if (id == CSSValueNone) {
             validPrimitive = true;
-        } else if (validUnit(value, FNumber | FLength | FNonNeg)) {
-            // Accepting valueless numbers is a quirk of the -webkit prefixed version of the property.
-            addProperty(propId, createPrimitiveNumericValue(value), important);
-            return true;
+        } else {
+            bool isCalculationValue = isCalculation(value);
+            if (validUnit(value, FNumber | FLength)) {
+                if (isCalculationValue || value->fValue > 0) {
+                    // Accepting valueless numbers is a quirk of the -webkit prefixed version of the property.
+                    addProperty(propId, createPrimitiveNumericValue(value), important);
+                    return true;
+                }
+            }
         }
         break;
     case CSSPropertyPerspectiveOrigin:
     case CSSPropertyWebkitPerspectiveOrigin: {
         RefPtrWillBeRawPtr<CSSValueList> list = parseTransformOrigin();
         if (!list || list->length() == 3)
             return false;
         // This values are added to match gecko serialization.
         if (list->length() == 1)
             list->append(cssValuePool().createValue(50, CSSPrimitiveValue::CSS_PERCENTAGE));
@@ skipping 7319 matching lines @@
         }
     }
 
     if (!list->length())
         return nullptr;
 
     return list.release();
 }
 
 } // namespace blink