The attached test has two examples of a shape defined by inset(10x round XXX) where XXX is one or two calc() values. These cause an immediate crash. Note: This uses testharness.js and the relative path in the test assumes the test is run from LayoutTests/fast/shapes/parsing
Created attachment 226028 [details] Test case for bug
Created attachment 228451 [details] Patch
Looks good to me, thanks Bem!
Comment on attachment 228451 [details] Patch r=me. Thanks to Zoltan for looking as well!
Comment on attachment 228451 [details] Patch Clearing flags on attachment: 228451 Committed r166726: <http://trac.webkit.org/changeset/166726>
All reviewed patches have been landed. Closing bug.
<rdar://problem/16517722>