[CSS Grid Layout] ASSERTION FAILED: repetitions > 0

Source/core/css/parser/CSSPropertyParser.cpp

Index: Source/core/css/parser/CSSPropertyParser.cpp
diff --git a/Source/core/css/parser/CSSPropertyParser.cpp b/Source/core/css/parser/CSSPropertyParser.cpp
index b2ce03f94f44094b1b6cff863858474c8d3e6b54..2150cc329d91cfbf5a2106649c0b2542247dc50c 100644
--- a/Source/core/css/parser/CSSPropertyParser.cpp
+++ b/Source/core/css/parser/CSSPropertyParser.cpp
@@ -3579,8 +3579,8 @@ bool CSSPropertyParser::parseGridTrackRepeatFunction(CSSValueList& list)
     if (!arguments || arguments->size() < 3 || !validUnit(arguments->valueAt(0), FPositiveInteger) || !isComma(arguments->valueAt(1)))
         return false;
 
-    size_t repetitions = arguments->valueAt(0)->fValue;
-    ASSERT_WITH_SECURITY_IMPLICATION(repetitions > 0);
+    ASSERT_WITH_SECURITY_IMPLICATION(arguments->valueAt(0)->fValue > 0);

[Julien - ping for review, 2014/10/21 19:22:36]

With clampTo, this ASSERT doesn't have security implications anymore as we won't
cast a negative float to a size_t.

Nit: I vote to downgrade it to a regular ASSERT.

[svillar, 2014/10/22 07:02:25]

I guess we shouldn't anyway because we have the
!validUnit(arguments->valueAt(0), FPositiveInteger) check above.
 
Let's do it before landing.

+    size_t repetitions = clampTo<size_t>(arguments->valueAt(0)->fValue, 0, kGridMaxTracks);
 
     RefPtrWillBeRawPtr<CSSValueList> repeatedValues = CSSValueList::createSpaceSeparated();
     arguments->next(); // Skip the repetition count.