Bug 129816 - [CSS Shapes] CRASH with calc() value args in inset round
Summary: [CSS Shapes] CRASH with calc() value args in inset round
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: CSS (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Major
Assignee: Bem Jones-Bey
URL:
Keywords: InRadar
Depends on:
Blocks: 98664
  Show dependency tree / graph
 
Reported: 2014-03-06 12:36 PST by Rebecca Hauck
Modified: 2014-04-03 15:15 PDT (History)
8 users (show)

See Also:

Attachments
Test case for bug (1.78 KB, text/html)
2014-03-06 12:36 PST, Rebecca Hauck 		no flags Details
Patch (4.69 KB, patch)
2014-04-02 18:12 PDT, Bem Jones-Bey 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Rebecca Hauck 2014-03-06 12:36:10 PST 
The attached test has two examples of a shape defined by inset(10x round XXX) where XXX is one or two calc() values.

These cause an immediate crash.

Note: This uses testharness.js and the relative path in the test assumes the test is run from LayoutTests/fast/shapes/parsing
Comment 1 Rebecca Hauck 2014-03-06 12:36:33 PST 
Created attachment 226028 [details]
Test case for bug
Comment 2 Bem Jones-Bey 2014-04-02 18:12:52 PDT 
Created attachment 228451 [details]
Patch
Comment 3 Zoltan Horvath 2014-04-02 19:51:31 PDT 
Looks good to me, thanks Bem!
Comment 4 Andreas Kling 2014-04-03 09:33:56 PDT 
Comment on attachment 228451 [details]
Patch

r=me. Thanks to Zoltan for looking as well!
Comment 5 WebKit Commit Bot 2014-04-03 09:49:00 PDT 
Comment on attachment 228451 [details]
Patch

Clearing flags on attachment: 228451

Committed r166726: <http://trac.webkit.org/changeset/166726>
Comment 6 WebKit Commit Bot 2014-04-03 09:49:05 PDT 
All reviewed patches have been landed.  Closing bug.
Comment 7 David Kilzer (:ddkilzer) 2014-04-03 15:15:47 PDT 
<rdar://problem/16517722>