[CSS Shapes] CRASH with calc() value args in inset round

[CSS Shapes] CRASH with calc() value args in inset round

The code to parse the inset rounded corners was adding the parser
value arguments to a temporary CSSParserValueList. Unfortunately,
CSSParserValueList expects to own the values it contains, and it frees
the values it contains when the list is destroyed. This was a problem
because the values are owned by the CSSParserValueList passed in to
parseInsetRoundedCorners, and thus the calc's argument list would get
double freed, resulting in a crash. This patch fixes this by using a
Vector to hold the pointers instead.

This is a merge of http://trac.webkit.org/changeset/166726 by Bem Jones-Bey <bjonesbe@adobe.com>;.

BUG=350055
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=170799

[Bem Jones-Bey (adobe), 2014-04-03 20:19:59]

lgtm

[rwlbuis, 2014-04-03 20:48:32]

PTAL Crash fixes are always nice to have IMHO :)

[eseidel, 2014-04-03 20:49:36]

lgtm

[rwlbuis, 2014-04-03 21:00:49]

The CQ bit was checked by rob.buis@samsung.com

[commit-bot: I haz the power, 2014-04-03 21:01:10]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/rob.buis@samsung.com/223673008/1

[commit-bot: I haz the power, 2014-04-03 22:09:03]

Change committed as 170799