<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - ASSERTION FAILED: m_fonts in &WebCore::FontCascade::primaryFont"
href="https://bugs.webkit.org/show_bug.cgi?id=163459#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - ASSERTION FAILED: m_fonts in &WebCore::FontCascade::primaryFont"
href="https://bugs.webkit.org/show_bug.cgi?id=163459">bug 163459</a>
from <span class="vcard"><a class="email" href="mailto:mmaxfield@apple.com" title="Myles C. Maxfield <mmaxfield@apple.com>"> <span class="fn">Myles C. Maxfield</span></a>
</span></b>
<pre>StyleBuilderCustom::applyValueFontSize()
This is because <math> elements get their on font-family.
We apply font properties in-order, so font-family comes first, then font-size.
When we apply font-family, if the element's font family matches the parent's font family, we don't create a new StyleInheritedData (because both elements can share). However, because <math> gets its own font family, the families don't match, so a new inherited data is created. This new inherited data's font descriptor hasn't been update()d. Then, we try to apply font-size, which erroneously tries to read from the current element's un-update()d font.
Font-dependent units are supposed to be resolved relative to the parent font size. We do this correctly with simple things like font-size: 2ch. However, once we start using calc(), StyleBuilderCustom::applyValueFontSize() takes a different code path.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>