[Webkit-unassigned] [Bug 14714] REGRESSION: ASSERTION FAILED: i < size() in Vector.h:401 on mangled HTML

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=14714





------- Comment #7 from ddkilzer at webkit.org  2007-07-22 15:29 PDT -------
(In reply to comment #6)
> Created an attachment (id=15628)
 --> (http://bugs.webkit.org/attachment.cgi?id=15628&action=view) [edit]
> Patch v1
> 
> Proposed patch.  Don't allow negative values for -webkit-column-width.
> 
> NOTE TO REVIEWER: I did not trace through the render code to determine why
> negative values failed.  I simply added the FNonNeg flag when parsing
> -webkit-column-width values to prevent non-negative numbers from being
> recognized as valid.

I should also note that all layout tests passed.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.