[css-typed-om] Fix crash when appending var refs.

We currently hit a DCHECK when appending a var ref. This patch fixes
the crash by rejecting it as per the spec.

Spec: https://github.com/w3c/css-houdini-drafts/commit/ecfcbf9721c0d7dff7890d8e009e4e3ad9b72d10

Bug: 814606
Change-Id: I144307bf489db5e968c8e326087d13554ec3e59c
Reviewed-on: https://chromium-review.googlesource.com/948142Reviewed-by: nainar <nainar@chromium.org>
Commit-Queue: Darren Shen <shend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#540938}

third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/declared/append.tentative.html

@@ -17,6 +17,8 @@ const gInvalidTestCases = [
   { property: 'transition-duration', values: [CSS.px(10)], desc: 'an invalid CSSStyleValue' },
   { property: 'transition-duration', values: ['10px'], desc: 'an invalid String value' },
   { property: 'transition-duration', values: [CSS.s(1), '10px', CSS.px(10)], desc: 'a mix of valid and invalid values' },
+  { property: 'transition-duration', values: [new CSSUnparsedValue([])], desc: 'a CSSUnparsedValue' },
+  { property: 'transition-duration', values: ['var(--A)'], desc: 'a var ref' },
 ];
 
 for (const {property, values, desc} of gInvalidTestCases) {

third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/declared/set.tentative.html

@@ -33,6 +33,22 @@ test(t => {
   assert_throws(new TypeError(), () => styleMap.set('width', '1s, 2s'));
 }, 'Setting a non list-valued property with list-valued string throws TypeError');
 
+test(t => {
+  let styleMap = createDeclaredStyleMap(t, '');
+  assert_throws(new TypeError(), () => {
+    styleMap.set('transition-duration', '1s', new CSSUnparsedValue([]));
+  });
+}, 'Setting a list-valued property with a CSSUnparsedValue and other ' +
+   'values throws TypeError');
+
+test(t => {
+  let styleMap = createDeclaredStyleMap(t, '');
+  assert_throws(new TypeError(), () => {
+    styleMap.set('transition-duration', '1s', 'var(--A)');
+  });
+}, 'Setting a list-valued property with a var ref() and other values ' +
+   'throws TypeError');
+
 test(t => {
   let styleMap = createDeclaredStyleMap(t, '');
 

third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/inline/append.tentative.html

@@ -17,6 +17,8 @@ const gInvalidTestCases = [
   { property: 'transition-duration', values: [CSS.px(10)], desc: 'an invalid CSSStyleValue' },
   { property: 'transition-duration', values: ['10px'], desc: 'an invalid String value' },
   { property: 'transition-duration', values: [CSS.s(1), '10px', CSS.px(10)], desc: 'a mix of valid and invalid values' },
+  { property: 'transition-duration', values: [new CSSUnparsedValue([])], desc: 'a CSSUnparsedValue' },
+  { property: 'transition-duration', values: ['var(--A)'], desc: 'a var ref' },
 ];
 
 for (const {property, values, desc} of gInvalidTestCases) {

third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/inline/set.tentative.html

@@ -33,6 +33,22 @@ test(t => {
   assert_throws(new TypeError(), () => styleMap.set('width', '1s, 2s'));
 }, 'Setting a non list-valued property with list-valued string throws TypeError');
 
+test(t => {
+  let styleMap = createInlineStyleMap(t, '');
+  assert_throws(new TypeError(), () => {
+    styleMap.set('transition-duration', '1s', new CSSUnparsedValue([]));
+  });
+}, 'Setting a list-valued property with a CSSUnparsedValue and other ' +
+   'values throws TypeError');
+
+test(t => {
+  let styleMap = createInlineStyleMap(t, '');
+  assert_throws(new TypeError(), () => {
+    styleMap.set('transition-duration', '1s', 'var(--A)');
+  });
+}, 'Setting a list-valued property with a var ref() and other values ' +
+   'throws TypeError');
+
 test(t => {
   let styleMap = createInlineStyleMap(t, '');
 

third_party/WebKit/Source/core/css/cssom/StylePropertyMap.cpp

@@ -213,12 +213,11 @@ void StylePropertyMap::append(const ExecutionContext* execution_context,
 
   const CSSValue* result =
       CoerceStyleValuesOrStrings(property, values, *execution_context);
-  if (!result) {
+  if (!result || !result->IsValueList()) {
     exception_state.ThrowTypeError("Invalid type for property");
     return;
   }
 
-  DCHECK(result->IsValueList());
   for (const auto& value : *ToCSSValueList(result)) {
     current_value->Append(*value);
   }