Properly hide 'advance-override' behind flag

crrev.com/c/2415244 introduced a new runtime flag for 'advance-override'
but didn't properly handle it in the parser. As a result, the descriptor
is leaked to web.

This patch fixes the parser to make sure it's properly hidden behind the
flag.

Bug: 1137624
Change-Id: I69f161932aede553b1cb31b181187e687eba1df0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2466979Reviewed-by: Rune Lillesveen <futhark@chromium.org>
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#816628}

third_party/blink/renderer/core/css/parser/at_rule_descriptor_parser.cc

@@ -205,7 +205,7 @@ CSSValue* ConsumeFontMetricOverride(CSSParserTokenRange& range,
 
 CSSValue* ConsumeAdvanceOverride(CSSParserTokenRange& range,
                                  const CSSParserContext& context) {
-  if (!RuntimeEnabledFeatures::CSSFontMetricsOverrideEnabled())
+  if (!RuntimeEnabledFeatures::CSSFontFaceAdvanceOverrideEnabled())
     return nullptr;
   return css_parsing_utils::ConsumeNumber(range, context, kValueRangeAll);
 }

third_party/blink/renderer/core/css/style_engine_test.cc

@@ -3241,6 +3241,34 @@ TEST_F(StyleEngineTest, MediaAttributeChangeUpdatesFontCacheVersion) {
   UpdateAllLifecyclePhases();
 }
 
+// https://crbug.com/1137624
+TEST_F(StyleEngineTest, DisabledAdvanceOverrideDescriptor) {
+  ScopedCSSFontFaceAdvanceOverrideForTest advance_override_disabled(false);
+
+  GetDocument().body()->setInnerHTML(R"HTML(
+    <style>
+      @font-face {
+        font-family: custom-font;
+        src: url(fake-font.woff);
+        advance-override: 0.1;
+      }
+    </style>
+  )HTML");
+
+  // Shouldn't crash.
+  UpdateAllLifecyclePhases();
+
+  // 'advance-override' should be ignored when disabled.
+  const FontFace* font_face = GetStyleEngine()
+                                  .GetFontSelector()
+                                  ->GetFontFaceCache()
+                                  ->CssConnectedFontFaces()
+                                  .front()
+                                  .Get();
+  ASSERT_TRUE(font_face);
+  EXPECT_FALSE(font_face->HasFontMetricsOverride());
+}
+
 class StyleEngineSimTest : public SimTest {};
 
 TEST_F(StyleEngineSimTest, OwnerColorScheme) {