[CSS Shapes] shape-outside: ellipse(50% 50% at) causes crash

Source/core/css/parser/CSSPropertyParser.cpp

 /*
  * Copyright (C) 2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
@@ skipping 4132 matching lines @@
         return nullptr;
 
     return createPrimitiveNumericValue(value);
 }
 
 PassRefPtrWillBeRawPtr<CSSBasicShape> CSSPropertyParser::parseBasicShapeCircle(CSSParserValueList* args)
 {
     ASSERT(args);
 
     // circle(radius)
-    // circle(radius at <position>
+    // circle(radius at <position>)
     // circle(at <position>)
     // where position defines centerX and centerY using a CSS <position> data type.
     RefPtrWillBeRawPtr<CSSBasicShapeCircle> shape = CSSBasicShapeCircle::create();
 
     for (CSSParserValue* argument = args->current(); argument; argument = args->next()) {
         // The call to parseFillPosition below should consume all of the
         // arguments except the first two. Thus, and index greater than one
         // indicates an invalid production.
         if (args->currentIndex() > 1)
             return nullptr;
 
         if (!args->currentIndex() && argument->id != CSSValueAt) {
             if (RefPtrWillBeRawPtr<CSSPrimitiveValue> radius = parseShapeRadius(argument)) {
                 shape->setRadius(radius);
                 continue;
             }
 
             return nullptr;
         }
 
-        if (argument->id == CSSValueAt) {
+        if (argument->id == CSSValueAt && args->next()) {
             RefPtrWillBeRawPtr<CSSValue> centerX;
             RefPtrWillBeRawPtr<CSSValue> centerY;
-            args->next(); // set list to start of position center
             parseFillPosition(args, centerX, centerY);
             if (centerX && centerY && !args->current()) {
                 ASSERT(centerX->isPrimitiveValue());
                 ASSERT(centerY->isPrimitiveValue());
                 shape->setCenterX(toCSSPrimitiveValue(centerX.get()));
                 shape->setCenterY(toCSSPrimitiveValue(centerY.get()));
             } else {
                 return nullptr;
             }
         } else {
@@ skipping 52 matching lines @@
     if (argumentNumber < 3)
         return nullptr;
     return shape;
 }
 
 PassRefPtrWillBeRawPtr<CSSBasicShape> CSSPropertyParser::parseBasicShapeEllipse(CSSParserValueList* args)
 {
     ASSERT(args);
 
     // ellipse(radiusX)
-    // ellipse(radiusX at <position>
+    // ellipse(radiusX at <position>)
     // ellipse(radiusX radiusY)
-    // ellipse(radiusX radiusY at <position>
+    // ellipse(radiusX radiusY at <position>)
     // ellipse(at <position>)
     // where position defines centerX and centerY using a CSS <position> data type.
     RefPtrWillBeRawPtr<CSSBasicShapeEllipse> shape = CSSBasicShapeEllipse::create();
 
     for (CSSParserValue* argument = args->current(); argument; argument = args->next()) {
         // The call to parseFillPosition below should consume all of the
         // arguments except the first three. Thus, an index greater than two
         // indicates an invalid production.
         if (args->currentIndex() > 2)
             return nullptr;
 
         if (args->currentIndex() < 2 && argument->id != CSSValueAt) {
             if (RefPtrWillBeRawPtr<CSSPrimitiveValue> radius = parseShapeRadius(argument)) {
                 if (!shape->radiusX())
                     shape->setRadiusX(radius);
                 else
                     shape->setRadiusY(radius);
                 continue;
             }
 
             return nullptr;
         }
 
-        if (argument->id != CSSValueAt)
+        if (argument->id != CSSValueAt || !args->next()) // expecting ellipse(.. at <position>)
             return nullptr;
         RefPtrWillBeRawPtr<CSSValue> centerX;
         RefPtrWillBeRawPtr<CSSValue> centerY;
-        args->next(); // set list to start of position center
         parseFillPosition(args, centerX, centerY);
         if (!centerX || !centerY || args->current())
             return nullptr;
 
         ASSERT(centerX->isPrimitiveValue());
         ASSERT(centerY->isPrimitiveValue());
         shape->setCenterX(toCSSPrimitiveValue(centerX.get()));
         shape->setCenterY(toCSSPrimitiveValue(centerY.get()));
     }
 
@@ skipping 4164 matching lines @@
         parsedValues->append(CSSPrimitiveValue::createIdentifier(CSSValueFill));
     if (!seenStroke)
         parsedValues->append(CSSPrimitiveValue::createIdentifier(CSSValueStroke));
     if (!seenMarkers)
         parsedValues->append(CSSPrimitiveValue::createIdentifier(CSSValueMarkers));
 
     return parsedValues.release();
 }
 
 } // namespace WebCore