Handle 'revert' in StylePropertySerializer::CommonShorthandChecks

The 'initial', 'inherit' and 'unset' keywords were handled, but
'revert' was not. This caused crashes when trying to represent certain
declaration block serializations using shorthands.

Change to use IsCSSWideKeyword instead, which includes 'revert'.
(It should also avoid the same problem the next time a new CSS-wide
keyword is added).

Bug: 1071454
Change-Id: I968a32a5ad5b2a1a1958f60ec19679c6a642df14
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2152817Reviewed-by: Yoav Weiss <yoavweiss@chromium.org>
Commit-Queue: Anders Hartvoll Ruud <andruud@chromium.org>
Cr-Commit-Position: refs/heads/master@{#760310}

third_party/blink/renderer/core/css/style_property_serializer.cc

@@ -402,9 +402,10 @@ String StylePropertySerializer::CommonShorthandChecks(
     const CSSValue& value = *longhands[i];
     if (!allow_initial && value.IsInitialValue())
       return g_empty_string;
-    if (value.IsInheritedValue() || value.IsUnsetValue() ||
-        value.IsPendingSubstitutionValue())
+    if ((value.IsCSSWideKeyword() && !value.IsInitialValue()) ||
+        value.IsPendingSubstitutionValue()) {
       return g_empty_string;
+    }
     if (value.IsVariableReferenceValue())
       return g_empty_string;
   }

third_party/blink/web_tests/external/wpt/css/cssom/css-style-attr-decl-block.html

@@ -130,4 +130,19 @@ test(function() {
   assert_not_equals(getComputedStyle(elem).backgroundImage, originalComputedValue,
                     "getComputedStyle(elem).backgroundImage after setting background-image");
 }, "Changes to CSS declaration block after a base URL change");
+
+test(function() {
+  let e1 = document.createElement('div');
+  let e2 = document.createElement('div');
+  document.body.append(e1, e2);
+  this.add_cleanup(() => {
+    e1.remove();
+    e2.remove();
+  });
+  e1.style.cssText = "all:revert;border-bottom-left-radius:1px;";
+  e2.style.cssText = "all:unset;border-bottom-left-radius:1px;";
+  let processed = e1.style.cssText.split(';')
+    .map(x => x.replace(/revert$/, 'unset')).join(';');
+  assert_equals(processed, e2.style.cssText);
+}, "Expansion of all:unset and all:revert treated identically");
 </script>