Bad cast from CSSInitialValue to CSSValueList

Bad cast from CSSInitialValue to CSSValueList
https://bugs.webkit.org/show_bug.cgi?id=121729

Source/WebCore:

Reviewed by Beth Dakin.

Merge https://chromium.googlesource.com/chromium/blink/+/fcfaa51f9207b32cffe751c1a1380a921e464cbb

The issue was that we would cast to CSSValueList without checking
the type of the CSSValue. After this change, we use the ASSERT'ing
cast and explicitly check the type of the CSSValue before the cast.

Test: fast/css/crash-inherit-value-font-family.html

* css/CSSParser.cpp:
(WebCore::CSSParser::parseFontFaceValue):

LayoutTests:

Reviewed by Beth Dakin.

Add a regression test. This is not a merge since the test in the Blink change involves
superfluous execCommand calls.

* fast/css/crash-inherit-value-font-family-expected.txt: Added.
* fast/css/crash-inherit-value-font-family.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@156222 268f45cc-cd09-0410-ab3c-d52691b4dbfc