[CSS Shapes] shape-outside: ellipse(50% 50% at) causes crash

The BasicShape ellipse and circle functions now report a syntax error
if the "at" keyword is not followed by a position.

The existing parsing tests have been updated to include this case.

Ported over from http://trac.webkit.org/changeset/165835

BUG=353774

Review URL: https://codereview.chromium.org/203413006

git-svn-id: svn://svn.chromium.org/blink/trunk@169583 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/LayoutTests/fast/shapes/parsing/parsing-shape-inside-expected.txt

@@ -247,6 +247,10 @@ PASS getCSSText("shape-inside", "circle(at center center 10px)") is ""
 PASS getComputedStyleValue("shape-inside", "circle(at center center 10px)") is "none"
 PASS getCSSText("shape-inside", "circle(at 10px 10px closest-side)") is ""
 PASS getComputedStyleValue("shape-inside", "circle(at 10px 10px closest-side)") is "none"
+PASS getCSSText("shape-inside", "circle(10px at)") is ""
+PASS getComputedStyleValue("shape-inside", "circle(10px at)") is "none"
+PASS getCSSText("shape-inside", "circle(at)") is ""
+PASS getComputedStyleValue("shape-inside", "circle(at)") is "none"
 PASS getCSSText("shape-inside", "ellipse(10px, 20px)") is ""
 PASS getComputedStyleValue("shape-inside", "ellipse(10px, 20px)") is "none"
 PASS getCSSText("shape-inside", "ellipse(10px, 20px, 30px)") is ""
@@ -269,6 +273,10 @@ PASS getCSSText("shape-inside", "ellipse(at 10px 10px at center)") is ""
 PASS getComputedStyleValue("shape-inside", "ellipse(at 10px 10px at center)") is "none"
 PASS getCSSText("shape-inside", "ellipse(at center center 10px)") is ""
 PASS getComputedStyleValue("shape-inside", "ellipse(at center center 10px)") is "none"
+PASS getCSSText("shape-inside", "ellipse(10px 20px at)") is ""
+PASS getComputedStyleValue("shape-inside", "ellipse(10px 20px at)") is "none"
+PASS getCSSText("shape-inside", "ellipse(at)") is ""
+PASS getComputedStyleValue("shape-inside", "ellipse(at)") is "none"
 PASS getCSSText("shape-inside", "polygon()") is ""
 PASS getComputedStyleValue("shape-inside", "polygon()") is "none"
 PASS getCSSText("shape-inside", "polygon(evenodd 10px 20px, 30px 40px, 40px 50px)") is ""

third_party/WebKit/LayoutTests/fast/shapes/parsing/parsing-shape-outside-expected.txt

@@ -245,6 +245,10 @@ PASS getCSSText("shape-outside", "circle(at center center 10px)") is ""
 PASS getComputedStyleValue("shape-outside", "circle(at center center 10px)") is "none"
 PASS getCSSText("shape-outside", "circle(at 10px 10px closest-side)") is ""
 PASS getComputedStyleValue("shape-outside", "circle(at 10px 10px closest-side)") is "none"
+PASS getCSSText("shape-outside", "circle(10px at)") is ""
+PASS getComputedStyleValue("shape-outside", "circle(10px at)") is "none"
+PASS getCSSText("shape-outside", "circle(at)") is ""
+PASS getComputedStyleValue("shape-outside", "circle(at)") is "none"
 PASS getCSSText("shape-outside", "ellipse(10px, 20px)") is ""
 PASS getComputedStyleValue("shape-outside", "ellipse(10px, 20px)") is "none"
 PASS getCSSText("shape-outside", "ellipse(10px, 20px, 30px)") is ""
@@ -267,6 +271,10 @@ PASS getCSSText("shape-outside", "ellipse(at 10px 10px at center)") is ""
 PASS getComputedStyleValue("shape-outside", "ellipse(at 10px 10px at center)") is "none"
 PASS getCSSText("shape-outside", "ellipse(at center center 10px)") is ""
 PASS getComputedStyleValue("shape-outside", "ellipse(at center center 10px)") is "none"
+PASS getCSSText("shape-outside", "ellipse(10px 20px at)") is ""
+PASS getComputedStyleValue("shape-outside", "ellipse(10px 20px at)") is "none"
+PASS getCSSText("shape-outside", "ellipse(at)") is ""
+PASS getComputedStyleValue("shape-outside", "ellipse(at)") is "none"
 PASS getCSSText("shape-outside", "polygon()") is ""
 PASS getComputedStyleValue("shape-outside", "polygon()") is "none"
 PASS getCSSText("shape-outside", "polygon(evenodd 10px 20px, 30px 40px, 40px 50px)") is ""

third_party/WebKit/LayoutTests/fast/shapes/parsing/parsing-test-utils.js

@@ -146,6 +146,8 @@ var invalidShapeValues = [
     "circle(at center center 10px)",
 
     "circle(at 10px 10px closest-side)",
+    "circle(10px at)",
+    "circle(at)",
 
     "ellipse(10px, 20px)", // FIXME: Remove this test once we do not support the deprecated CSS Shapes syntax anymore.
     "ellipse(10px, 20px, 30px)", // FIXME: Remove this test once we do not support the deprecated CSS Shapes syntax anymore.
@@ -159,6 +161,8 @@ var invalidShapeValues = [
     "ellipse(at 10px 10px 10px)",
     "ellipse(at 10px 10px at center)",
     "ellipse(at center center 10px)",
+    "ellipse(10px 20px at)",
+    "ellipse(at)",
 
     "polygon()",
     "polygon(evenodd 10px 20px, 30px 40px, 40px 50px)",

third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp

@@ -4150,7 +4150,7 @@ PassRefPtrWillBeRawPtr<CSSBasicShape> CSSPropertyParser::parseBasicShapeCircle(C
     ASSERT(args);
 
     // circle(radius)
-    // circle(radius at <position>
+    // circle(radius at <position>)
     // circle(at <position>)
     // where position defines centerX and centerY using a CSS <position> data type.
     RefPtrWillBeRawPtr<CSSBasicShapeCircle> shape = CSSBasicShapeCircle::create();
@@ -4171,10 +4171,9 @@ PassRefPtrWillBeRawPtr<CSSBasicShape> CSSPropertyParser::parseBasicShapeCircle(C
             return nullptr;
         }
 
-        if (argument->id == CSSValueAt) {
+        if (argument->id == CSSValueAt && args->next()) {
             RefPtrWillBeRawPtr<CSSValue> centerX;
             RefPtrWillBeRawPtr<CSSValue> centerY;
-            args->next(); // set list to start of position center
             parseFillPosition(args, centerX, centerY);
             if (centerX && centerY && !args->current()) {
                 ASSERT(centerX->isPrimitiveValue());
@@ -4247,9 +4246,9 @@ PassRefPtrWillBeRawPtr<CSSBasicShape> CSSPropertyParser::parseBasicShapeEllipse(
     ASSERT(args);
 
     // ellipse(radiusX)
-    // ellipse(radiusX at <position>
+    // ellipse(radiusX at <position>)
     // ellipse(radiusX radiusY)
-    // ellipse(radiusX radiusY at <position>
+    // ellipse(radiusX radiusY at <position>)
     // ellipse(at <position>)
     // where position defines centerX and centerY using a CSS <position> data type.
     RefPtrWillBeRawPtr<CSSBasicShapeEllipse> shape = CSSBasicShapeEllipse::create();
@@ -4273,11 +4272,10 @@ PassRefPtrWillBeRawPtr<CSSBasicShape> CSSPropertyParser::parseBasicShapeEllipse(
             return nullptr;
         }
 
-        if (argument->id != CSSValueAt)
+        if (argument->id != CSSValueAt || !args->next()) // expecting ellipse(.. at <position>)
             return nullptr;
         RefPtrWillBeRawPtr<CSSValue> centerX;
         RefPtrWillBeRawPtr<CSSValue> centerY;
-        args->next(); // set list to start of position center
         parseFillPosition(args, centerX, centerY);
         if (!centerX || !centerY || args->current())
             return nullptr;