ASSERT: Bad cast from CSSInitialValue to CSSValueList

Source/core/css/CSSParser-in.cpp

Index: Source/core/css/CSSParser-in.cpp
diff --git a/Source/core/css/CSSParser-in.cpp b/Source/core/css/CSSParser-in.cpp
index 8907000f6087060f6bb068e600e091bfa4c0c538..a030e7fb9453814bf26c3d9273f3dea15228a402 100644
--- a/Source/core/css/CSSParser-in.cpp
+++ b/Source/core/css/CSSParser-in.cpp
@@ -1148,7 +1148,12 @@ PassRefPtr<CSSValueList> CSSParser::parseFontFaceValue(const AtomicString& strin
     RefPtr<MutableStylePropertySet> dummyStyle = MutableStylePropertySet::create();
     if (!parseValue(dummyStyle.get(), CSSPropertyFontFamily, string, false, CSSQuirksMode, 0))
         return 0;
-    return static_pointer_cast<CSSValueList>(dummyStyle->getPropertyCSSValue(CSSPropertyFontFamily));
+
+    RefPtr<CSSValue> fontFamily = dummyStyle->getPropertyCSSValue(CSSPropertyFontFamily);
+    if (!fontFamily->isValueList())
+        return 0;
+
+    return toCSSValueList(dummyStyle->getPropertyCSSValue(CSSPropertyFontFamily).leakRef());

[eseidel, 2013/09/03 22:40:23]

leakRef?  You mean release and static_ptr_cast?

[Julien - ping for review, 2013/09/03 23:17:41]

I don't want to use static_ptr_cast as it is unsafe (ie isn't protected by an
assert).

I missed the fact that leakRef doesn't touch the ref count so I would need an
adoptRef for this to work. I will just use .get() and let the ref count be
touched twice then.

 }
 
 bool CSSParser::parseValue(MutableStylePropertySet* declaration, CSSPropertyID propertyID, const String& string, bool important, const Document& document)