Negative values for stroke-dasharray should be rejected. (Bug 585715) r=bzbarsky a2.0=blocking2.0:beta6

layout/style/nsCSSParser.cpp

@@ -154,6 +154,7 @@ namespace css = mozilla::css;
 #define VARIANT_HN   (VARIANT_INHERIT | VARIANT_NUMBER)
 #define VARIANT_HON  (VARIANT_HN | VARIANT_NONE)
 #define VARIANT_HOS  (VARIANT_INHERIT | VARIANT_NONE | VARIANT_STRING)
+#define VARIANT_LPN  (VARIANT_LP | VARIANT_NUMBER)
 #define VARIANT_TIMING_FUNCTION (VARIANT_KEYWORD | VARIANT_CUBIC_BEZIER)
 #define VARIANT_UK   (VARIANT_URL | VARIANT_KEYWORD)
 #define VARIANT_UO   (VARIANT_URL | VARIANT_NONE)
@@ -9034,9 +9035,7 @@ CSSParserImpl::ParseDasharray()
   } else {
     nsCSSValueList *cur = value.SetListValue();
     for (;;) {
-      if (!ParseVariant(cur->mValue,
-                        VARIANT_LENGTH | VARIANT_PERCENT | VARIANT_NUMBER,
-                        nsnull)) {
+      if (!ParseNonNegativeVariant(cur->mValue, VARIANT_LPN, nsnull)) {
         return PR_FALSE;
       }
       if (CheckEndProperty()) {

layout/style/test/property_database.js

@@ -2867,7 +2867,7 @@ var gCSSProperties = {
 		type: CSS_TYPE_LONGHAND,
 		initial_values: [ "none" ],
 		other_values: [ "5px,3px,2px", "5px 3px 2px", "  5px ,3px	, 2px ", "1px", "5%", "3em" ],
-		invalid_values: []
+		invalid_values: [ "-5px,3px,2px", "5px,3px,-2px" ]
 	},
 	"stroke-dashoffset": {
 		domProp: "strokeDashoffset",