[webkit-reviews] review requested: [Bug 12239] REGRESSION (r18816-r18818): Assertion failure in WebCore::Length::Length[in-charge](int, WebCore::LengthType, bool) : [Attachment 12408] Patch v1

[bugzilla-request-daemon at macosforge.org]

David Kilzer (ddkilzer) <ddkilzer at webkit.org> has asked  for review:
Bug 12239: REGRESSION (r18816-r18818): Assertion failure in
WebCore::Length::Length[in-charge](int, WebCore::LengthType, bool)
http://bugs.webkit.org/show_bug.cgi?id=12239

Attachment 12408: Patch v1
http://bugs.webkit.org/attachment.cgi?id=12408&action=edit

------- Additional Comments from David Kilzer (ddkilzer) <ddkilzer at webkit.org>
Proposed fix and layout test.