Add check that the CSSValue is a valid type in CSSTransformComponent before casting.

BUG=641995

Review-Url: https://codereview.chromium.org/2313523002
Cr-Commit-Position: refs/heads/master@{#417535}

third_party/WebKit/LayoutTests/typedcssom/inlinestyle/transform.html

@@ -3,6 +3,7 @@
 <script src="../../resources/testharnessreport.js"></script>
 
 <div id="testElement"></div>
+<div id="crashTest" style="transform:translateY(50px)"></div>
 
 <script>
 
@@ -22,5 +23,8 @@ test(function() {
   assert_equals(testElement.styleMap.get('transform').cssText, 'rotate(30deg)');
 }, "Getting transform works on a regular element.");
 
+test(function() {
+  crashTest.styleMap.entries();
+}, "Unhandled case doesn't crash.");
 
 </script>

third_party/WebKit/Source/core/css/cssom/CSSTransformComponent.cpp

@@ -15,6 +15,9 @@ namespace blink {
 
 CSSTransformComponent* CSSTransformComponent::fromCSSValue(const CSSValue& value)
 {
+    if (!value.isFunctionValue())
+        return nullptr;
+
     const CSSFunctionValue& functionValue = toCSSFunctionValue(value);
     switch (functionValue.functionType()) {
     case CSSValueMatrix: