Bug 129816

Summary: [CSS Shapes] CRASH with calc() value args in inset round
Product: WebKit Reporter: Rebecca Hauck <rhauck>
Component: CSSAssignee: Bem Jones-Bey <bjonesbe>
Status: RESOLVED FIXED    
Severity: Major CC: bjonesbe, commit-queue, esprehn+autocc, glenn, gyuyoung.kim, macpherson, menard, zoltan
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 98664    
Attachments:
Description Flags
Test case for bug
none
Patch none

Rebecca Hauck
Reported 2014-03-06 12:36:10 PST
The attached test has two examples of a shape defined by inset(10x round XXX) where XXX is one or two calc() values. These cause an immediate crash. Note: This uses testharness.js and the relative path in the test assumes the test is run from LayoutTests/fast/shapes/parsing
Attachments
Test case for bug (1.78 KB, text/html)
2014-03-06 12:36 PST, Rebecca Hauck 		no flags
Details
Patch (4.69 KB, patch)
2014-04-02 18:12 PDT, Bem Jones-Bey 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Rebecca Hauck
Comment 1 2014-03-06 12:36:33 PST
Created attachment 226028 [details] Test case for bug
Bem Jones-Bey
Comment 2 2014-04-02 18:12:52 PDT
Created attachment 228451 [details] Patch
Zoltan Horvath
Comment 3 2014-04-02 19:51:31 PDT
Looks good to me, thanks Bem!
Andreas Kling
Comment 4 2014-04-03 09:33:56 PDT
Comment on attachment 228451 [details] Patch r=me. Thanks to Zoltan for looking as well!
WebKit Commit Bot
Comment 5 2014-04-03 09:49:00 PDT
Comment on attachment 228451 [details] Patch Clearing flags on attachment: 228451 Committed r166726: <http://trac.webkit.org/changeset/166726>
WebKit Commit Bot
Comment 6 2014-04-03 09:49:05 PDT
All reviewed patches have been landed. Closing bug.
David Kilzer (:ddkilzer)
Comment 7 2014-04-03 15:15:47 PDT
<rdar://problem/16517722>
Note You need to log in before you can comment on or make changes to this bug.