[Webkit-unassigned] [Bug 122073] New: shape-outside assertion when 2nd argument of polygon coordinate is calc

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=122073

           Summary: shape-outside assertion when 2nd argument of polygon
                    coordinate is calc
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: CSS
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: krit at webkit.org
                CC: giles_joplin at yahoo.com, betravis at adobe.com


Created an attachment (id=212916)
 --> (https://bugs.webkit.org/attachment.cgi?id=212916&action=review)
Assertion

If the second argument of a polygon coordinate is calc() then we get an assertion in the CSSParser code:
    -webkit-shape-outside: polygon(0% 0%, 0% calc(100% - 20px), 100% 100%);

The following cod does not assert:
    -webkit-shape-outside: polygon(0% 0%, calc(100% - 20px) 0%, 100% 100%);

ASSERTION FAILED: isCalculation(value)
webkit/Source/WebCore/css/CSSParser.cpp(1762) : PassRefPtr<WebCore::CSSPrimitiveValue> WebCore::CSSParser::createPrimitiveNumericValue(WebCore::CSSParserValue *)
1   0x10d93abc0 WTFCrash
2   0x10eafaa2a WebCore::CSSParser::createPrimitiveNumericValue(WebCore::CSSParserValue*)
3   0x10eae45e9 WebCore::CSSParser::parseBasicShapePolygon(WebCore::CSSParserValueList*)
4   0x10eade6e1 WebCore::CSSParser::parseBasicShape(WebCore::CSSPropertyID, bool)
5   0x10eacd17e WebCore::CSSParser::parseValue(WebCore::CSSPropertyID, bool)
6   0x10eaac340 cssyyparse(WebCore::CSSParser*)

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.