Bug 129816 - [CSS Shapes] CRASH with calc() value args in inset round
Summary: [CSS Shapes] CRASH with calc() value args in inset round
Alias: None
Product: WebKit
Classification: Unclassified
Component: CSS (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Major
Assignee: Bem Jones-Bey
Keywords: InRadar
Depends on:
Blocks: 98664
  Show dependency treegraph
Reported: 2014-03-06 12:36 PST by Rebecca Hauck
Modified: 2014-04-03 15:15 PDT (History)
8 users (show)

See Also:

Test case for bug (1.78 KB, text/html)
2014-03-06 12:36 PST, Rebecca Hauck
no flags Details
Patch (4.69 KB, patch)
2014-04-02 18:12 PDT, Bem Jones-Bey
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Rebecca Hauck 2014-03-06 12:36:10 PST
The attached test has two examples of a shape defined by inset(10x round XXX) where XXX is one or two calc() values.

These cause an immediate crash.

Note: This uses testharness.js and the relative path in the test assumes the test is run from LayoutTests/fast/shapes/parsing
Comment 1 Rebecca Hauck 2014-03-06 12:36:33 PST
Created attachment 226028 [details]
Test case for bug
Comment 2 Bem Jones-Bey 2014-04-02 18:12:52 PDT
Created attachment 228451 [details]
Comment 3 Zoltan Horvath 2014-04-02 19:51:31 PDT
Looks good to me, thanks Bem!
Comment 4 Andreas Kling 2014-04-03 09:33:56 PDT
Comment on attachment 228451 [details]

r=me. Thanks to Zoltan for looking as well!
Comment 5 WebKit Commit Bot 2014-04-03 09:49:00 PDT
Comment on attachment 228451 [details]

Clearing flags on attachment: 228451

Committed r166726: <http://trac.webkit.org/changeset/166726>
Comment 6 WebKit Commit Bot 2014-04-03 09:49:05 PDT
All reviewed patches have been landed.  Closing bug.
Comment 7 David Kilzer (:ddkilzer) 2014-04-03 15:15:47 PDT