[functions] Validate defaults against their type

The spec was recently clarified to make @function rules
with "mistyped" defaults invalid. For example, the following
is now invalid, because the default given for --arg doesn't match
the type given for --arg:

  @function --foo(--arg <color>: 10px) { /* ... */ }

w3c/csswg-drafts#12243

Fixed: 423673310
Change-Id: I3239b573ece22bb48746a496758d53f57ac00b70
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6632858
Commit-Queue: Anders Hartvoll Ruud <andruud@chromium.org>
Reviewed-by: Steinar H Gunderson <sesse@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1472448}

Author: andruud

third_party/blink/renderer/core/css/parser/css_parser_impl.cc

@@ -2413,8 +2413,7 @@ CSSParserImpl::ConsumeFunctionParameters(CSSParserTokenStream& stream) {
     }
     stream.ConsumeIncludingWhitespace();
 
-    CSSSyntaxDefinition type = ConsumeFunctionType(stream).value_or(
-        CSSSyntaxDefinition::CreateUniversal());
+    std::optional<CSSSyntaxDefinition> type = ConsumeFunctionType(stream);
 
     CSSVariableData* default_value = nullptr;
     if (stream.Peek().GetType() == kColonToken) {
@@ -2432,8 +2431,22 @@ CSSParserImpl::ConsumeFunctionParameters(CSSParserTokenStream& stream) {
           /*comma_ends_declaration=*/true, important_ignored, *context_);
     }
 
+    // If a type and a default are both provided, the default must
+    // parse successfully according to that type.
+    //
+    // https://drafts.csswg.org/css-mixins-1/#function-rule
+    if (type.has_value() && default_value) {
+      if (!default_value->NeedsVariableResolution() &&
+          !type->Parse(default_value->OriginalText(), *context_,
+                       /*is_animation_tainted=*/false,
+                       /*is_attr_tainted=*/false)) {
+        return std::nullopt;
+      }
+    }
+
     parameters.push_back(StyleRuleFunction::Parameter{
-        parameter_name, std::move(type), default_value});
+        parameter_name, type.value_or(CSSSyntaxDefinition::CreateUniversal()),
+        default_value});
     if (stream.Peek().GetType() == kRightParenthesisToken) {
       // No more arguments.
       break;

third_party/blink/web_tests/external/wpt/css/css-mixins/at-function-parsing.html

@@ -60,6 +60,7 @@
 
   // Defaults.
   test_valid_prelude('@function --foo(--x : 10px)');
+  test_valid_prelude('@function --foo(--x type(*): 10px)');
   test_valid_prelude('@function --foo(--x <length>: 10px)');
   test_valid_prelude('@function --foo(--x <length>: 10px, --y)');
   test_valid_prelude('@function --foo(--x, --y <length>: 10px)');
@@ -69,11 +70,16 @@
   // a default, even though there's no way to actually call --foo()
   // with just --y:
   test_valid_prelude('@function --foo(--x:1px, --y, --z:2px)');
-  // The value does not have to match the type during @function parsing:
-  test_valid_prelude('@function --foo(--x <angle>: 10px)');
 
   test_invalid_prelude('@function --foo(--x: 10px !important)');
 
+  // Default type mismatch.
+  test_invalid_prelude('@function --foo(--x <length>: 10deg)');
+  test_invalid_prelude('@function --foo(--x <angle>: 10px)');
+  test_invalid_prelude('@function --foo(--x <color>: 10px)');
+  test_invalid_prelude('@function --foo(--x type(<color>+): red 5)');
+  test_invalid_prelude('@function --foo(--x type(auto | none): thing)');
+
   // Lists.
   test_valid_prelude('@function --foo(--x <length>#)');
   test_valid_prelude('@function --foo(--x <length>+)');