[css-typed-om] Fix crash involving negative length perspectives.

We were crashing because converting CSSPerspective(-1px) to a CSSValue
returns nullptr. The correct behaviour should be to convert it as
CSSPerspective(calc(-1px)).

Bug: 812620
Change-Id: I5ee70d4fb5eed064bcdad67391c3eb84531144d6
Reviewed-on: https://chromium-review.googlesource.com/924742
Commit-Queue: Darren Shen <shend@chromium.org>
Reviewed-by: nainar <nainar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#537690}

third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-serialization/cssTransformValue.tentative.html

@@ -64,6 +64,11 @@ const gTestCases = [
     cssText: 'perspective(1px)',
     desc: 'CSSPerspective'
   },
+  {
+    value: new CSSPerspective(CSS.px(-1)),
+    cssText: 'perspective(calc(-1px))',
+    desc: 'CSSPerspective with negative length'
+  },
   {
     value: new CSSTransformValue([new CSSPerspective(CSS.px(1))]),
     cssText: 'perspective(1px)',

third_party/WebKit/Source/core/css/cssom/CSSPerspective.cpp

@@ -5,6 +5,7 @@
 #include "core/css/cssom/CSSPerspective.h"
 
 #include "bindings/core/v8/ExceptionState.h"
+#include "core/css/CSSCalculationValue.h"
 #include "core/css/cssom/CSSUnitValue.h"
 #include "core/geometry/DOMMatrix.h"
 
@@ -63,15 +64,17 @@ DOMMatrix* CSSPerspective::toMatrix(ExceptionState& exception_state) const {
 }
 
 const CSSFunctionValue* CSSPerspective::ToCSSValue() const {
+  const CSSValue* length = nullptr;
   if (length_->IsUnitValue() && ToCSSUnitValue(length_)->value() < 0) {
-    // Negative values are invalid.
-    // https://github.com/w3c/css-houdini-drafts/issues/420
-    return nullptr;
+    // Wrap out of range length with a calc.
+    CSSCalcExpressionNode* node = length_->ToCalcExpressionNode();
+    node->SetIsNestedCalc();
+    length = CSSPrimitiveValue::Create(CSSCalcValue::Create(node));
+  } else {
+    length = length_->ToCSSValue();
   }
-  const CSSValue* length = length_->ToCSSValue();
-  if (!length)
-    return nullptr;
 
+  DCHECK(length);
   CSSFunctionValue* result = CSSFunctionValue::Create(CSSValuePerspective);
   result->Append(*length);
   return result;