Making -webkit-image-set() the first value of background property causes crash.
https://bugs.webkit.org/show_bug.cgi?id=108409

Reviewed by Beth Dakin.

Source/WebCore:

CSSParser::addFillValue should use lval->isBaseValueList() instead
of lval->isValueList(). If lval is -webkit-image-set, rval is appended
to -webkit-image-set.

Test: fast/css/image-set-value-crash-in-fillImageSet.html

* css/CSSParser.cpp:
(WebCore::CSSParser::addFillValue):
If lval is not a value list, lval is initialized by using
CSSValueList::createCommaSeparated(). So we have to check whether
lval is created by CSSValueList::createCommaSeparated() or not.

LayoutTests:

* fast/css/image-set-value-crash-in-fillImageSet-expected.txt: Added.
* fast/css/image-set-value-crash-in-fillImageSet.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141701 268f45cc-cd09-0410-ab3c-d52691b4dbfc