Bug 129816

Summary: [CSS Shapes] CRASH with calc() value args in inset round
Product: WebKit Reporter: Rebecca Hauck <rhauck>
Component: CSSAssignee: Bem Jones-Bey <bjonesbe>
Status: RESOLVED FIXED    
Severity: Major CC: bjonesbe, commit-queue, esprehn+autocc, glenn, gyuyoung.kim, macpherson, menard, zoltan
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 98664    
Attachments:
Description Flags
Test case for bug
none
Patch none

Description Rebecca Hauck 2014-03-06 12:36:10 PST 
The attached test has two examples of a shape defined by inset(10x round XXX) where XXX is one or two calc() values.

These cause an immediate crash.

Note: This uses testharness.js and the relative path in the test assumes the test is run from LayoutTests/fast/shapes/parsing
Comment 1 Rebecca Hauck 2014-03-06 12:36:33 PST 
Created attachment 226028 [details]
Test case for bug
Comment 2 Bem Jones-Bey 2014-04-02 18:12:52 PDT 
Created attachment 228451 [details]
Patch
Comment 3 Zoltan Horvath 2014-04-02 19:51:31 PDT 
Looks good to me, thanks Bem!
Comment 4 Andreas Kling 2014-04-03 09:33:56 PDT 
Comment on attachment 228451 [details]
Patch

r=me. Thanks to Zoltan for looking as well!
Comment 5 WebKit Commit Bot 2014-04-03 09:49:00 PDT 
Comment on attachment 228451 [details]
Patch

Clearing flags on attachment: 228451

Committed r166726: <http://trac.webkit.org/changeset/166726>
Comment 6 WebKit Commit Bot 2014-04-03 09:49:05 PDT 
All reviewed patches have been landed.  Closing bug.
Comment 7 David Kilzer (:ddkilzer) 2014-04-03 15:15:47 PDT 
<rdar://problem/16517722>