1 files changed, 22 insertions, 16 deletions

diff --git a/chromium/third_party/blink/renderer/core/css/css_math_expression_node.cc b/chromium/third_party/blink/renderer/core/css/css_math_expression_node.cc
index 3f5ed024a0c..82f0a055f5d 100644
--- a/chromium/third_party/blink/renderer/core/css/css_math_expression_node.cc
+++ b/chromium/third_party/blink/renderer/core/css/css_math_expression_node.cc
@@ -39,8 +39,6 @@
 #include "third_party/blink/renderer/platform/wtf/math_extras.h"
 #include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
 
-static const int maxExpressionDepth = 100;
-
 enum ParseState { OK, TooDeep, NoMoreTokens };
 
 namespace blink {
@@ -69,6 +67,15 @@ static CalculationCategory UnitCategory(CSSPrimitiveValue::UnitType type) {
     case CSSPrimitiveValue::UnitType::kViewportMin:
     case CSSPrimitiveValue::UnitType::kViewportMax:
       return kCalcLength;
+    case CSSPrimitiveValue::UnitType::kContainerWidth:
+    case CSSPrimitiveValue::UnitType::kContainerHeight:
+    case CSSPrimitiveValue::UnitType::kContainerInlineSize:
+    case CSSPrimitiveValue::UnitType::kContainerBlockSize:
+    case CSSPrimitiveValue::UnitType::kContainerMin:
+    case CSSPrimitiveValue::UnitType::kContainerMax:
+      return RuntimeEnabledFeatures::CSSContainerRelativeUnitsEnabled()
+                 ? kCalcLength
+                 : kCalcOther;
     case CSSPrimitiveValue::UnitType::kDegrees:
     case CSSPrimitiveValue::UnitType::kGradians:
     case CSSPrimitiveValue::UnitType::kRadians:
@@ -113,6 +120,12 @@ static bool HasDoubleValue(CSSPrimitiveValue::UnitType type) {
     case CSSPrimitiveValue::UnitType::kViewportHeight:
     case CSSPrimitiveValue::UnitType::kViewportMin:
     case CSSPrimitiveValue::UnitType::kViewportMax:
+    case CSSPrimitiveValue::UnitType::kContainerWidth:
+    case CSSPrimitiveValue::UnitType::kContainerHeight:
+    case CSSPrimitiveValue::UnitType::kContainerInlineSize:
+    case CSSPrimitiveValue::UnitType::kContainerBlockSize:
+    case CSSPrimitiveValue::UnitType::kContainerMin:
+    case CSSPrimitiveValue::UnitType::kContainerMax:
     case CSSPrimitiveValue::UnitType::kDotsPerPixel:
     case CSSPrimitiveValue::UnitType::kDotsPerInch:
     case CSSPrimitiveValue::UnitType::kDotsPerCentimeter:
@@ -1055,15 +1068,6 @@ bool CSSMathExpressionVariadicOperation::InvolvesPercentageComparisons() const {
 
 // ------ End of CSSMathExpressionVariadicOperation member functions
 
-static ParseState CheckDepthAndIndex(int* depth, CSSParserTokenRange tokens) {
-  (*depth)++;
-  if (tokens.AtEnd())
-    return NoMoreTokens;
-  if (*depth > maxExpressionDepth)
-    return TooDeep;
-  return OK;
-}
-
 class CSSMathExpressionNodeParser {
   STACK_ALLOCATED();
 
@@ -1082,7 +1086,7 @@ class CSSMathExpressionNodeParser {
                                        CSSMathOperator op,
                                        int depth) {
     DCHECK(op == CSSMathOperator::kMin || op == CSSMathOperator::kMax);
-    if (CheckDepthAndIndex(&depth, tokens) != OK)
+    if (tokens.AtEnd())
       return nullptr;
 
     CSSMathExpressionVariadicOperation::Operands operands;
@@ -1108,7 +1112,7 @@ class CSSMathExpressionNodeParser {
   }
 
   CSSMathExpressionNode* ParseClamp(CSSParserTokenRange tokens, int depth) {
-    if (CheckDepthAndIndex(&depth, tokens) != OK)
+    if (tokens.AtEnd())
       return nullptr;
 
     CSSMathExpressionNode* min_operand = ParseValueExpression(tokens, depth);
@@ -1184,7 +1188,7 @@ class CSSMathExpressionNodeParser {
 
   CSSMathExpressionNode* ParseValueTerm(CSSParserTokenRange& tokens,
                                         int depth) {
-    if (CheckDepthAndIndex(&depth, tokens) != OK)
+    if (tokens.AtEnd())
       return nullptr;
 
     if (tokens.Peek().GetType() == kLeftParenthesisToken ||
@@ -1222,7 +1226,7 @@ class CSSMathExpressionNodeParser {
   CSSMathExpressionNode* ParseValueMultiplicativeExpression(
       CSSParserTokenRange& tokens,
       int depth) {
-    if (CheckDepthAndIndex(&depth, tokens) != OK)
+    if (tokens.AtEnd())
       return nullptr;
 
     CSSMathExpressionNode* result = ParseValueTerm(tokens, depth);
@@ -1253,7 +1257,7 @@ class CSSMathExpressionNodeParser {
   CSSMathExpressionNode* ParseAdditiveValueExpression(
       CSSParserTokenRange& tokens,
       int depth) {
-    if (CheckDepthAndIndex(&depth, tokens) != OK)
+    if (tokens.AtEnd())
       return nullptr;
 
     CSSMathExpressionNode* result =
@@ -1290,6 +1294,8 @@ class CSSMathExpressionNodeParser {
 
   CSSMathExpressionNode* ParseValueExpression(CSSParserTokenRange& tokens,
                                               int depth) {
+    if (++depth > kMaxExpressionDepth)
+      return nullptr;
     return ParseAdditiveValueExpression(tokens, depth);
   }
 };