ASSERTION FAILED: !m_parsedCalculation in CSSPropertyParser::parseCalculation

Source/core/css/parser/CSSPropertyParser.cpp

 /*
  * Copyright (C) 2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
@@ skipping 5536 matching lines @@
                 return nullptr;
             }
             // The value is good.  Commit it.
             context.commitValue();
         } else if (validUnit(val, FLength, HTMLStandardMode)) {
             // We required a length and didn't get one. Invalid.
             if (!context.allowLength())
                 return nullptr;
 
             // Blur radius must be non-negative.
-            if (context.allowBlur && !validUnit(val, FLength | FNonNeg, HTMLStandardMode))
+            if (context.allowBlur && ((m_parsedCalculation && m_parsedCalculation->isNegative())
+                || !validUnit(val, FLength | FNonNeg, HTMLStandardMode)))

[rune, 2015/02/18 19:09:54]

Won't this still hit the assert for positive calc expressions?
(m_parsedCalculation && !m_parsedCalculation->isNegative() will call
validUnit())

                 return nullptr;
 
             // A length is allowed here.  Construct the value and add it.
             context.commitLength(val);
         } else if (val->id == CSSValueInset) {
             if (!context.allowStyle)
                 return nullptr;
 
             context.commitStyle(val);
         } else {
@@ skipping 2978 matching lines @@
         }
     }
 
     if (!list->length())
         return nullptr;
 
     return list.release();
 }
 
 } // namespace blink