Move two shape related properties into CSSPropertyParser

third_party/WebKit/Source/core/css/CSSBasicShapeValues.cpp

Index: third_party/WebKit/Source/core/css/CSSBasicShapeValues.cpp
diff --git a/third_party/WebKit/Source/core/css/CSSBasicShapeValues.cpp b/third_party/WebKit/Source/core/css/CSSBasicShapeValues.cpp
index 432805181e45b1292d8cc04b37eb99bcdf730828..3a2651b77dfe6060c0afae203a1f84efadd4b32a 100644
--- a/third_party/WebKit/Source/core/css/CSSBasicShapeValues.cpp
+++ b/third_party/WebKit/Source/core/css/CSSBasicShapeValues.cpp
@@ -88,10 +88,10 @@ static PassRefPtrWillBeRawPtr<CSSValuePair> buildSerializablePositionOffset(Pass
         side = defaultSide;
         amount = cssValuePool().createValue(50, CSSPrimitiveValue::UnitType::Percentage);
     } else if ((side == CSSValueRight || side == CSSValueBottom)
-        && amount->isPercentage()) {
+        && amount && amount->isPercentage()) {

[Timothy Loh, 2016/01/27 00:44:03]

What changed to make us need this?

[rwlbuis, 2016/01/27 20:02:39]

parseFillPosition has a special ResolveValuesAsPercent mode, that
consumePosition does not have. So in the case of positions of length 1 or 2 this
mode was used, primitive values with percentages were created instead of value
ids, and we end up with a non-null value for amount.

But consumePosition does not have this mode, so we just have a single side value
and null amount for standalone left/right/bottom/top values, causing crashes in
the two else blocks if nothing is changed.

In my latest code I at least moved the middle block up, since the if check can
only succeed with a CSSValuePair, this way we at least get rid of one amount
null check.

         side = defaultSide;
         amount = cssValuePool().createValue(100 - amount->getFloatValue(), CSSPrimitiveValue::UnitType::Percentage);
-    } else if (amount->isLength() && !amount->getFloatValue()) {
+    } else if (!amount || (amount->isLength() && !amount->getFloatValue())) {
         if (side == CSSValueRight || side == CSSValueBottom)
             amount = cssValuePool().createValue(100, CSSPrimitiveValue::UnitType::Percentage);
         else