Perspective property should only allow positive lengths

Source/core/css/parser/CSSPropertyParser.cpp

Index: Source/core/css/parser/CSSPropertyParser.cpp
diff --git a/Source/core/css/parser/CSSPropertyParser.cpp b/Source/core/css/parser/CSSPropertyParser.cpp
index 0b8df4c88135ebd2ba29e633c737f826baf32011..ab038e5ef4e465625f0993d9e3fcaf08d855d893 100644
--- a/Source/core/css/parser/CSSPropertyParser.cpp
+++ b/Source/core/css/parser/CSSPropertyParser.cpp
@@ -1153,18 +1153,28 @@ bool CSSPropertyParser::parseValue(CSSPropertyID propId, bool important)
     case CSSPropertyPerspective:
         if (id == CSSValueNone) {
             validPrimitive = true;
-        } else if (validUnit(value, FLength | FNonNeg)) {
-            addProperty(propId, createPrimitiveNumericValue(value), important);
-            return true;
+        } else {
+            bool isCalculationValue = isCalculation(value);
+            if (validUnit(value, FLength)) {
+                if (isCalculationValue || value->fValue > 0) {
+                    addProperty(propId, createPrimitiveNumericValue(value), important);
+                    return true;
+                }
+            }

[alancutter (OOO until 2018), 2015/03/16 23:33:15]

This can probably be simplified as:
if (id == CSSValueNone)
    validPrimitive = true;
else if (validUnit(value, FLength) && (m_parsedCalculation || value->fValue >
0))
    validPrimitive = true;
else
    return false;

Similarly below.

         }
         break;
     case CSSPropertyWebkitPerspective:
         if (id == CSSValueNone) {
             validPrimitive = true;
-        } else if (validUnit(value, FNumber | FLength | FNonNeg)) {
-            // Accepting valueless numbers is a quirk of the -webkit prefixed version of the property.
-            addProperty(propId, createPrimitiveNumericValue(value), important);
-            return true;
+        } else {
+            bool isCalculationValue = isCalculation(value);
+            if (validUnit(value, FNumber | FLength)) {
+                if (isCalculationValue || value->fValue > 0) {
+                    // Accepting valueless numbers is a quirk of the -webkit prefixed version of the property.
+                    addProperty(propId, createPrimitiveNumericValue(value), important);
+                    return true;
+                }
+            }
         }
         break;
     case CSSPropertyPerspectiveOrigin: