[Webkit-unassigned] [Bug 14714] REGRESSION: ASSERTION FAILED: i < size() in Vector.h:401 on mangled HTML
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Sun Jul 22 14:43:52 PDT 2007
http://bugs.webkit.org/show_bug.cgi?id=14714
ddkilzer at webkit.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #15628| |review?
Flag| |
------- Comment #6 from ddkilzer at webkit.org 2007-07-22 14:43 PDT -------
Created an attachment (id=15628)
--> (http://bugs.webkit.org/attachment.cgi?id=15628&action=view)
Patch v1
Proposed patch. Don't allow negative values for -webkit-column-width.
NOTE TO REVIEWER: I did not trace through the render code to determine why
negative values failed. I simply added the FNonNeg flag when parsing
-webkit-column-width values to prevent non-negative numbers from being
recognized as valid.
--
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
More information about the webkit-unassigned
mailing list