Two tests attached that exhibit this - one is the W3C reftest that uncovered it (and is derived from this explicit example in the spec), the other is a simplified javascript parsing test that passes when a url() value is given and fails on the att() case. The actual image is not needed for these cases, but attaching one just to make the test whole. Note: This uses testharness.js and the relative path in the test assumes the test is run from LayoutTests/fast/shapes/parsing
Created attachment 228557 [details] Test case for bug
Created attachment 228558 [details] ref file for test
Created attachment 228559 [details] parsing test
Created attachment 228560 [details] image file for tests
This use of attr() is not implemented in WebKit in general, so shape-outside will not be able to support it until attr() itself supports URLs.