[CSS Shapes] CRASH with calc() value args in inset round

Source/core/css/parser/CSSPropertyParser.cpp

Index: Source/core/css/parser/CSSPropertyParser.cpp
diff --git a/Source/core/css/parser/CSSPropertyParser.cpp b/Source/core/css/parser/CSSPropertyParser.cpp
index 8a1a6428c0099c4056ac1fe5ad1c26c682dcacfe..94d422a18e6f13550844a5e7674d558a295fc74c 100644
--- a/Source/core/css/parser/CSSPropertyParser.cpp
+++ b/Source/core/css/parser/CSSPropertyParser.cpp
@@ -4023,9 +4023,9 @@ PassRefPtrWillBeRawPtr<CSSBasicShape> CSSPropertyParser::parseInsetRoundedCorner
     if (!argument)
         return nullptr;
 
-    CSSParserValueList radiusArguments;
+    Vector<CSSParserValue*> radiusArguments;
     while (argument) {
-        radiusArguments.addValue(*argument);
+        radiusArguments.append(argument);
         argument = args->next();
     }
 
@@ -4042,7 +4042,7 @@ PassRefPtrWillBeRawPtr<CSSBasicShape> CSSPropertyParser::parseInsetRoundedCorner
 
     unsigned indexAfterSlash = 0;
     for (unsigned i = 0; i < num; ++i) {
-        CSSParserValue* value = radiusArguments.valueAt(i);
+        CSSParserValue* value = radiusArguments.at(i);
         if (value->unit == CSSParserValue::Operator) {
             if (value->iValue != '/')
                 return nullptr;