[image-set] type() function should only take one string

https://bugs.webkit.org/show_bug.cgi?id=256323
rdar://108909363

Reviewed by Tim Nguyen.

Parsing for the image-set type() function is both too restricted and not
strict enough. On the one hand, type( "image/png") (note the leading
space) would be rejected while type("image/png" "image/png") would be
accepted.

This change fixes both issues by being a little more smart about
handling the parser tokens passed to it and leaning on consumeString
being able to handle leading and trailing whitespace tokens.

We also need to be careful about not modifying the passed-in
CSSParserTokenRange until after we've validated that the argument to
type() was a single string. Otherwise we will hit an assert in the
resolution calc() consumer.

* LayoutTests/imported/w3c/web-platform-tests/css/css-images/image-set/image-set-parsing-expected.txt:
* Source/WebCore/css/parser/CSSPropertyParserHelpers.cpp:
(WebCore::CSSPropertyParserHelpers::ImageSetTypeCSSPrimitiveValueKnownTokenTypeFunctionConsumer::consume):

Canonical link: https://commits.webkit.org/264310@main

LayoutTests/imported/w3c/web-platform-tests/css/css-images/image-set/image-set-parsing-expected.txt

@@ -121,8 +121,8 @@ PASS e.style['background-image'] = "image-set(url(example.png) type(image/png))"
 PASS e.style['background-image'] = "-webkit-image-set(url(example.png) type(image/png))" should not set the property value
 PASS e.style['background-image'] = "image-set(url(example.png) type('image/png') type('image/png'))" should not set the property value
 PASS e.style['background-image'] = "-webkit-image-set(url(example.png) type('image/png') type('image/png'))" should not set the property value
-FAIL e.style['background-image'] = "image-set(url(example.png) type('image/png' 'image/png'))" should not set the property value assert_equals: expected "" but got "image-set(url(\"example.png\") 1x type(\"image/png\"))"
-FAIL e.style['background-image'] = "-webkit-image-set(url(example.png) type('image/png' 'image/png'))" should not set the property value assert_equals: expected "" but got "image-set(url(\"example.png\") 1x type(\"image/png\"))"
+PASS e.style['background-image'] = "image-set(url(example.png) type('image/png' 'image/png'))" should not set the property value
+PASS e.style['background-image'] = "-webkit-image-set(url(example.png) type('image/png' 'image/png'))" should not set the property value
 PASS e.style['background-image'] = "image-set(url(example.png) type(url('image/png')))" should not set the property value
 PASS e.style['background-image'] = "-webkit-image-set(url(example.png) type(url('image/png')))" should not set the property value
 PASS e.style['background-image'] = "image-set(url(example.png) 1xtype('image/png'))" should not set the property value

Source/WebCore/css/parser/CSSPropertyParserHelpers.cpp

@@ -837,11 +837,18 @@ struct ImageSetTypeCSSPrimitiveValueKnownTokenTypeFunctionConsumer {
     static RefPtr<CSSPrimitiveValue> consume(CSSParserTokenRange& range, const CSSCalcSymbolTable&, ValueRange, CSSParserMode, UnitlessQuirk, UnitlessZeroQuirk)
     {
         ASSERT(range.peek().type() == FunctionToken);
-        if (range.peek().functionId() != CSSValueType || range.peek(1).type() != StringToken)
+        if (range.peek().functionId() != CSSValueType)
             return nullptr;
 
-        auto typeArg = consumeFunction(range);
-        return consumeString(typeArg);
+        auto rangeCopy = range;
+        auto typeArg = consumeFunction(rangeCopy);
+        auto result = consumeString(typeArg);
+
+        if (!result || !typeArg.atEnd())
+            return nullptr;
+
+        range = rangeCopy;
+        return result;
     }
 };