Bug 68760

Summary: REGRESSION (r95502): Assertion failure in CSSPrimitiveValue::computeLengthDouble() when media query specifies unit-less length
Product: WebKit Reporter: mitz
Component: CSSAssignee: mitz
Status: RESOLVED FIXED    
Severity: Normal CC: hyatt, koivisto
Priority: P1 Keywords: Regression
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
URL: http://hulu.com
Attachments:
Description Flags
Make length-comparison media queries accept only length values koivisto: review+

Description mitz 2011-09-24 11:35:45 PDT
To reproduce, visit the URL, or try

<style>
    @media all and (min-width:0) {
    body { }
}
</style>

Result:

SHOULD NEVER BE REACHED
WebCore/css/CSSPrimitiveValue.cpp(404) : double WebCore::CSSPrimitiveValue::computeLengthDouble(WebCore::RenderStyle *, WebCore::RenderStyle *, double, bool)

the primitiveType() is CSS_NUMBER, which is not expected in the switch() statement.
Comment 1 mitz 2011-09-24 12:08:27 PDT
Not sure what’s the right place to fix this. Perhaps the MediaQueryExp constructor, which already does a validity check, should also do feature-specific checks, similar to the CSS parser (using something like CSSParser::validUnit()).
Comment 2 mitz 2011-10-01 16:26:14 PDT
The assertion was added in <http://trac.webkit.org/r95502>, uncovering a preexisting bug.
Comment 3 mitz 2011-10-01 21:22:40 PDT
Created attachment 109416 [details]
Make length-comparison media queries accept only length values
Comment 4 Antti Koivisto 2011-10-02 00:59:26 PDT
Comment on attachment 109416 [details]
Make length-comparison media queries accept only length values

r=me
Comment 5 mitz 2011-10-02 01:24:46 PDT
Fixed in <http://trac.webkit.org/r96471>.