Perspective property should only allow positive lengths

Source/core/css/parser/CSSPropertyParser.cpp

Index: Source/core/css/parser/CSSPropertyParser.cpp
diff --git a/Source/core/css/parser/CSSPropertyParser.cpp b/Source/core/css/parser/CSSPropertyParser.cpp
index 0b8df4c88135ebd2ba29e633c737f826baf32011..6bcd6468ce775275417f82cf6c9a396bafb2f900 100644
--- a/Source/core/css/parser/CSSPropertyParser.cpp
+++ b/Source/core/css/parser/CSSPropertyParser.cpp
@@ -1154,17 +1154,23 @@ bool CSSPropertyParser::parseValue(CSSPropertyID propId, bool important)
         if (id == CSSValueNone) {
             validPrimitive = true;
         } else if (validUnit(value, FLength | FNonNeg)) {
-            addProperty(propId, createPrimitiveNumericValue(value), important);
-            return true;
+            if (m_parsedCalculation ? m_parsedCalculation->isPositive() : value->fValue > 0) {
+                addProperty(propId, createPrimitiveNumericValue(value), important);
+                return true;
+            }
+            return false;
         }
         break;
     case CSSPropertyWebkitPerspective:
         if (id == CSSValueNone) {
             validPrimitive = true;
         } else if (validUnit(value, FNumber | FLength | FNonNeg)) {
-            // Accepting valueless numbers is a quirk of the -webkit prefixed version of the property.
-            addProperty(propId, createPrimitiveNumericValue(value), important);
-            return true;
+            if (m_parsedCalculation ? m_parsedCalculation->isPositive() : value->fValue > 0) {
+                // Accepting valueless numbers is a quirk of the -webkit prefixed version of the property.
+                addProperty(propId, createPrimitiveNumericValue(value), important);
+                return true;
+            }
+            return false;
         }
         break;
     case CSSPropertyPerspectiveOrigin: