Bug 744243 - Forbid odd trailing slash in CSS 'border-image' property. r=dbaron

layout/style/nsCSSParser.cpp

@@ -6739,11 +6739,11 @@ CSSParserImpl::ParseBorderImage()
 {
   nsAutoParseCompoundProperty compound(this);
 
-  // border-image: inherit |
+  // border-image: inherit | -moz-initial |
   // <border-image-source> ||
   // <border-image-slice>
-  //   [ / <border-image-width>?
-  //     [ / <border-image-outset>]?]? ||
+  //   [ / <border-image-width> |
+  //     / <border-image-width>? / <border-image-outset> ]? ||
   // <border-image-repeat>
 
   nsCSSValue value;
@@ -6753,7 +6753,7 @@ CSSParserImpl::ParseBorderImage()
     AppendValue(eCSSProperty_border_image_width, value);
     AppendValue(eCSSProperty_border_image_outset, value);
     AppendValue(eCSSProperty_border_image_repeat, value);
-    // Keyword "inherit" can't be mixed, so we are done.
+    // Keyword "inherit" (and "-moz-initial") can't be mixed, so we are done.
     return true;
   }
 
@@ -6792,13 +6792,17 @@ CSSParserImpl::ParseBorderImage()
 
         // [ / <border-image-width>?
         if (ExpectSymbol('/', true)) {
-          ParseBorderImageWidth(false);
+          bool foundBorderImageWidth = ParseBorderImageWidth(false);
 
           // [ / <border-image-outset>
           if (ExpectSymbol('/', true)) {
             if (!ParseBorderImageOutset(false)) {
               return false;
             }
+          } else if (!foundBorderImageWidth) {
+            // If this part has an trailing slash, the whole declaration is 
+            // invalid.
+            return false;
           }
         }
 

layout/style/test/property_database.js

@@ -250,16 +250,21 @@ var gCSSProperties = {
 						"repeat 27 27 27 27 / 10 10 10 / 10 10 url('border.png')",
 						"url('border.png') 27 27 27 27 / / 10 10 1em",
 						"fill 27 27 27 27 / / 10 10 1em url('border.png')",
-						"url('border.png') 27 27 27 27 /",
 						"url('border.png') 27 27 27 27 / 1em 1em 1em 1em repeat",
 						"url('border.png') 27 27 27 27 / 1em 1em 1em 1em stretch round" ],
 		invalid_values: [ "url('border.png') 27 27 27 27 27",
 						  "url('border.png') 27 27 27 27 / 1em 1em 1em 1em 1em",
+						  "url('border.png') 27 27 27 27 /",
 						  "url('border.png') fill",
 						  "url('border.png') fill repeat",
 						  "fill repeat",
 						  "url('border.png') fill / 1em",
-						  "url('border.png') / repeat" ]
+						  "url('border.png') / repeat",
+						  "url('border.png') 1 /",
+						  "url('border.png') 1 / /",
+						  "1 / url('border.png')",
+						  "url('border.png') / 1",
+						  "url('border.png') / / 1"]
 	},
 	"-moz-border-image-source": {
 		domProp: "MozBorderImageSource",