Bug 67474 – heightMediaFeatureEval NULL ptr

• Component: CSS
• Status: RESOLVED DUPLICATE

[Berend-Jan Wever]

Created attachment 106116 [details]
Repro

static bool heightMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame, MediaFeaturePrefix op)
{
    FrameView* view = frame->view();
    RenderStyle* rootStyle = frame->document()->documentElement()->renderStyle(); // KaB00m
<<<snip>>>

Repro.html:
<script>
  oWin=open('bad.svg');
  // Wait for bad svg to load an error message HTML to be generated.
  setTimeout(function() {
    var oBody = oWin.document.body;
    var oHtml = oWin.document.documentElement;
    oBody.parentElement.removeChild(oBody);
    oBody.insertBefore(oHtml);
  }, 100);
</script>

bad.svg:
<?xml version="1.0" standalone="no"?>
<?xml-stylesheet type="text/css" href="repro.css" ?>
<svg [this triggers an error]

repro.css:
@media (height:0) {
  @page  {
    * {
    }
  }
}

[Berend-Jan Wever]

Chromium: https://code.google.com/p/chromium/issues/detail?id=95185

[Berend-Jan Wever]

*** This bug has been marked as a duplicate of bug 66219 ***