Stop parse-time range checking on SVG non-negative lengths in math functions

According to spec (*), we shouldn't perform range checking for
math function at parse time. This patch stops such checking on
SVG lengths.

This also eliminates an improper call of
CSSMathFunctionValue::DoubleValue(), so that we can put runtime
unit type checking in there.

(*) https://drafts.csswg.org/css-values-4/#calc-range

Bug: 979895, 982425
Change-Id: Id7abfcda611c23216127818e7e2473b065116fd6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1693132
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Reviewed-by: Emil A Eklund <eae@chromium.org>
Cr-Commit-Position: refs/heads/master@{#676453}

third_party/blink/renderer/core/svg/svg_animated_length.cc

@@ -39,9 +39,13 @@ SVGParsingError SVGAnimatedLength::AttributeChanged(const String& value) {
       SVGAnimatedProperty<SVGLength>::AttributeChanged(value);
 
   if (SVGLength::NegativeValuesForbiddenForAnimatedLengthAttribute(
-          AttributeName()) &&
-      BaseValue()->ValueInSpecifiedUnits() < 0)
-    parse_status = SVGParseStatus::kNegativeValue;
+          AttributeName())) {
+    // TODO(crbug.com/982425): Pass |kValueRangeNonNegative| to property parser
+    // to handle range checking on math functions correctly, and also to avoid
+    // this ad hoc range checking.
+    if (BaseValue()->IsNegativeNumericLiteral())
+      parse_status = SVGParseStatus::kNegativeValue;
+  }
 
   return parse_status;
 }

third_party/blink/renderer/core/svg/svg_length.cc

@@ -360,4 +360,10 @@ void SVGLength::SetInitial(unsigned initial_value) {
   value_ = CreateInitialCSSValue(static_cast<Initial>(initial_value));
 }
 
+bool SVGLength::IsNegativeNumericLiteral() const {
+  if (!value_->IsNumericLiteralValue())
+    return false;
+  return value_->GetDoubleValue() < 0;
+}
+
 }  // namespace blink

third_party/blink/renderer/core/svg/svg_length.h

@@ -114,6 +114,7 @@ class SVGLength final : public SVGPropertyBase {
   bool IsFontRelative() const { return value_->IsFontRelativeLength(); }
   bool IsCalculated() const { return value_->IsCalculated(); }
 
+  bool IsNegativeNumericLiteral() const;
   bool IsZero() const { return value_->GetFloatValue() == 0; }
 
   static SVGLengthMode LengthModeForAnimatedLengthAttribute(

third_party/blink/web_tests/svg/custom/rect-calc-corner-radii-expected.svg

+<svg xmlns="http://www.w3.org/2000/svg" width="500" height="500">
+    <rect  x="50" y="50"  width="400" height="400" rx="0"  ry="0"  fill="#00ff00" />
+    <rect x="150" y="100" width="200" height="300" rx="50" ry="50" fill="#0000ff" />
+    <rect x="200" y="150" width="100" height="200" rx="50" ry="50" fill="#ff0000" />
+</svg>

third_party/blink/web_tests/svg/custom/rect-calc-corner-radii-expected.txt

+CONSOLE ERROR: line 4: Error: <rect> attribute ry: A negative value is not valid. ("-100")

third_party/blink/web_tests/svg/custom/rect-calc-corner-radii.svg

+<svg xmlns="http://www.w3.org/2000/svg" width="500" height="500">
+    <rect  x="50" y="50"  width="400" height="400" rx="calc(-50)"  ry="calc(-50)"  fill="#00ff00" />
+    <rect x="150" y="100" width="200" height="300" rx="calc(20% - 50)" ry="50" fill="#0000ff" />
+    <rect x="200" y="150" width="100" height="200" rx="50" ry="-100" fill="#ff0000" />
+</svg>