[Webkit-unassigned] [Bug 67474] New: heightMediaFeatureEval NULL ptr

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Fri Sep 2 04:50:44 PDT 2011


https://bugs.webkit.org/show_bug.cgi?id=67474

           Summary: heightMediaFeatureEval NULL ptr
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Windows Vista
            Status: NEW
          Severity: Normal
          Priority: P1
         Component: CSS
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: skylined at chromium.org
                CC: eric at webkit.org


Created an attachment (id=106116)
 --> (https://bugs.webkit.org/attachment.cgi?id=106116&action=review)
Repro

static bool heightMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame, MediaFeaturePrefix op)
{
    FrameView* view = frame->view();
    RenderStyle* rootStyle = frame->document()->documentElement()->renderStyle(); // KaB00m
<<<snip>>>

Repro.html:
<script>
  oWin=open('bad.svg');
  // Wait for bad svg to load an error message HTML to be generated.
  setTimeout(function() {
    var oBody = oWin.document.body;
    var oHtml = oWin.document.documentElement;
    oBody.parentElement.removeChild(oBody);
    oBody.insertBefore(oHtml);
  }, 100);
</script>

bad.svg:
<?xml version="1.0" standalone="no"?>
<?xml-stylesheet type="text/css" href="repro.css" ?>
<svg [this triggers an error]

repro.css:
@media (height:0) {
  @page  {
    * {
    }
  }
}

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.



More information about the webkit-unassigned mailing list