[CSS Shapes] shape-outside: ellipse(50% 50% at) causes crash

LayoutTests/fast/shapes/parsing/parsing-test-utils.js

 // Valid values for both shape-inside and shape-outside. Two values are specified when the shape property value
 // differs from the specified value. Three values are specified when the computed shape property value differs
 // from the specified value.
 // eg: "specified value/CSS Text value/computed style value"
 // or: ["specified value", "CSS Text value/computed style value"]
 // or: ["specified value", "CSS Text value", "Computed style value"]
 var validShapeValues = [
     "none",
     ["rectangle(10px, 20px, 30px, 40px)", "rectangle(10px, 20px, 30px, 40px)", "rectangle(10px, 20px, 30px, 40px, 0px, 0px)"],
     ["rectangle(10px, 20px, 30px, 40px, 5px)", "rectangle(10px, 20px, 30px, 40px, 5px)", "rectangle(10px, 20px, 30px, 40px, 5px, 5px)"],
@@ skipping 128 matching lines @@
 
     "circle(10px 20px)",
     "circle(10px at 10px 10px 10px)",
     "circle(10px at 10px 10px at center)",
     "circle(10px at center center 10px)",
     "circle(at 10px 10px 10px)",
     "circle(at 10px 10px at center)",
     "circle(at center center 10px)",
 
     "circle(at 10px 10px closest-side)",
+    "circle(10px at)",
+    "circle(at)",
 
     "ellipse(10px, 20px)", // FIXME: Remove this test once we do not support the deprecated CSS Shapes syntax anymore.
     "ellipse(10px, 20px, 30px)", // FIXME: Remove this test once we do not support the deprecated CSS Shapes syntax anymore.
     "ellipse(10px 20px 30px 40px)", // FIXME: Remove this test once we do not support the deprecated CSS Shapes syntax anymore.
 
     "ellipse(10px 20px 30px)",
     "ellipse(10px at 10px 10px 10px)",
     "ellipse(10px at 10px 10px at center)",
     "ellipse(10px at center center 10px)",
     "ellipse(10px 20px 30px at center center 10px)",
     "ellipse(at 10px 10px 10px)",
     "ellipse(at 10px 10px at center)",
     "ellipse(at center center 10px)",
+    "ellipse(10px 20px at)",
+    "ellipse(at)",
 
     "polygon()",
     "polygon(evenodd 10px 20px, 30px 40px, 40px 50px)",
     "polygon(nonzero 10px 20px, 30px 40px, 40px 50px)",
     "polygon(nonzero)",
     "polygon(evenodd)",
     "polygon(10px)",
     "polygon(nonzero,10px)",
     "polygon(evenodd,12px)",
     "polygon(10px, 20px, 30px, 40px, 40px, 50px)",
@@ skipping 111 matching lines @@
 
 function testNotInheritedShapeProperty(property, parentValue, childValue, expectedValue)
 {
     shouldBeEqualToString('getParentAndChildComputedStylesString("' + property + '", "' + parentValue + '", "' + childValue + '")', expectedValue);
 }
 
 function applyToEachArglist(testFunction, arglists)
 {
     arglists.forEach(function(arglist, i, a) {testFunction.apply(null, arglist);});
 }