[CSS Grid Layout] CSSParser should reject <track-list> without a <track-size>

Source/core/css/CSSParser.cpp

 /*
  * Copyright (C) 2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
@@ skipping 4577 matching lines @@
     CSSParserValue* value = m_valueList->current();
     if (value->id == CSSValueNone) {
         if (m_valueList->next())
             return false;
 
         addProperty(propId, cssValuePool().createIdentifierValue(value->id), important);
         return true;
     }
 
     RefPtr<CSSValueList> values = CSSValueList::createSpaceSeparated();
-    size_t currentLineNumber = 0;
+    // Handle leading <string>*.
+    while (m_valueList->current() && m_valueList->current()->unit == CSSPrimitiveValue::CSS_STRING) {
+        RefPtr<CSSPrimitiveValue> name = createPrimitiveStringValue(m_valueList->current());
+        values->append(name);
+        m_valueList->next();
+    }
+
+    bool seenTrackSize = false;
     while (m_valueList->current()) {
+        RefPtr<CSSPrimitiveValue> primitiveValue = parseGridTrackSize();
+        if (!primitiveValue)
+            return false;
+
+        seenTrackSize = true;
+        values->append(primitiveValue.release());
+
+        // This will handle the trailing <string>* in the grammar.
         while (m_valueList->current() && m_valueList->current()->unit == CSSPrimitiveValue::CSS_STRING) {
             RefPtr<CSSPrimitiveValue> name = createPrimitiveStringValue(m_valueList->current());
             values->append(name);
             m_valueList->next();
         }
+    }
 
-        // This allows trailing <string>* per the specification.
-        if (!m_valueList->current())
-            break;
+    // We should have found a <track-size> or else it is not a valid <track-list>
+    if (!seenTrackSize)
+        return false;
 
-        RefPtr<CSSPrimitiveValue> primitiveValue = parseGridTrackSize();
-        if (!primitiveValue)
-            return false;
-
-        values->append(primitiveValue.release());
-    }
     addProperty(propId, values.release(), important);
     return true;
 }
 
 PassRefPtr<CSSPrimitiveValue> CSSParser::parseGridTrackSize()
 {
     ASSERT(RuntimeEnabledFeatures::cssGridLayoutEnabled());
 
     CSSParserValue* currentValue = m_valueList->current();
     m_valueList->next();
@@ skipping 7180 matching lines @@
 {
     // The tokenizer checks for the construct of an+b.
     // However, since the {ident} rule precedes the {nth} rule, some of those
     // tokens are identified as string literal. Furthermore we need to accept
     // "odd" and "even" which does not match to an+b.
     return equalIgnoringCase(token, "odd") || equalIgnoringCase(token, "even")
         || equalIgnoringCase(token, "n") || equalIgnoringCase(token, "-n");
 }
 
 }