130542 2014-03-20 15:54:29 -0700 Inline style allows numbers with scientific notations without further checking: assert! 2014-03-20 19:15:23 -0700 1 1 1 Unclassified WebKit CSS 528+ (Nightly build) Unspecified Unspecified NEW P2 Normal --- 1 krit webkit-unassigned dino kling koivisto simon.fraser tonikitoo oldest_to_newest 992774 0 227349 krit 2014-03-20 15:54:29 -0700 Created attachment 227349 Example - assertion The parsing for setting inline style with JS seems to differ from markup parsing. The following is interpreted as number with scientific notation: 2e500 The numbers seem not to be checked for overflow: document.getElementsByTagName('div')[0].style.marginTop = '2e500px'; causes an ASSERT: ASSERTION FAILED: std::isfinite(num) CSSPrimitiveValue.cpp(259) : WebCore::CSSPrimitiveValue::CSSPrimitiveValue(double, WebCore::CSSPrimitiveValue::UnitTypes) 1 0x1059f0a30 WTFCrash 2 0x107548bec WebCore::CSSPrimitiveValue::CSSPrimitiveValue(double, WebCore::CSSPrimitiveValue::UnitTypes) 3 0x107548af5 WebCore::CSSPrimitiveValue::CSSPrimitiveValue(double, WebCore::CSSPrimitiveValue::UnitTypes) 4 0x10744e5d1 WebCore::CSSPrimitiveValue::create(double, WebCore::CSSPrimitiveValue::UnitTypes) 5 0x107593c94 WebCore::CSSValuePool::createValue(double, WebCore::CSSPrimitiveValue::UnitTypes) 6 0x1074edef5 WebCore::parseSimpleLengthValue(WebCore::MutableStyleProperties*, WebCore::CSSPropertyID, WTF::String const&, bool, WebCore::CSSParserMode) 7 0x1074edbd0 WebCore::CSSParser::parseValue(WebCore::MutableStyleProperties*, WebCore::CSSPropertyID, WTF::String const&, bool, WebCore::CSSParserMode, WebCore::StyleSheetContents*) 8 0x108db260f WebCore::MutableStyleProperties::setProperty(WebCore::CSSPropertyID, WTF::String const&, bool, WebCore::StyleSheetContents*) 992865 1 tonikitoo 2014-03-20 19:15:23 -0700 Duplicated of bug 127361? 227349 2014-03-20 15:54:29 -0700 2014-03-20 15:54:29 -0700 Example - assertion crash.html text/html 99 krit PGRpdj48L2Rpdj4KPHNjcmlwdD4KZG9jdW1lbnQuZ2V0RWxlbWVudHNCeVRhZ05hbWUoJ2Rpdicp WzBdLnN0eWxlLm1hcmdpblRvcCA9ICcyZTUwMHB4JzsKPC9zY3JpcHQ+