Perspective property should only allow positive lengths

Source/core/css/CSSCalculationValue.h

Index: Source/core/css/CSSCalculationValue.h
diff --git a/Source/core/css/CSSCalculationValue.h b/Source/core/css/CSSCalculationValue.h
index d296407b9b9470540aa803104ff4dedb215f3963..b1c77ee64cba1a22ad2f636d072432c0797feb88 100644
--- a/Source/core/css/CSSCalculationValue.h
+++ b/Source/core/css/CSSCalculationValue.h
@@ -119,6 +119,7 @@ public:
     bool isInt() const { return m_expression->isInteger(); }
     double doubleValue() const;
     bool isNegative() const { return m_expression->doubleValue() < 0; }
+    bool isPositive() const { return m_expression->doubleValue() > 0; }

[alancutter (OOO until 2018), 2015/03/12 03:43:08]

The doubleValue() function is broken for lengths and should probably
ASSERT_NOT_REACHED() in these cases.

The calc spec defers clamping of the value until a final value can be produced:
http://dev.w3.org/csswg/css-values-3/#calc-range

We should just allow calcs in the parser and clamp appropriately in
convertPerspectiveLength().
At the moment it clamps to >= 0 which seems incorrect for perspective. Instead
we should probably clamp to a small value like 1e-8 otherwise we treat 0 as none
which is an implementation detail rather than spec described behaviour.

     ValueRange permittedValueRange() { return m_nonNegative ? ValueRangeNonNegative : ValueRangeAll; }
     double computeLengthPx(const CSSToLengthConversionData&) const;
     void accumulateLengthArray(CSSLengthArray& lengthArray, CSSLengthTypeArray& lengthTypeArray, double multiplier) const { m_expression->accumulateLengthArray(lengthArray, lengthTypeArray, multiplier); }