Fix number handling in accumulatePixelsAndPercent.

Source/core/css/parser/CSSPropertyParser.cpp

 /*
  * Copyright (C) 2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
@@ skipping 4666 matching lines @@
 bool CSSPropertyParser::parseLineHeight(bool important)
 {
     CSSParserValue* value = m_valueList->current();
     CSSValueID id = value->id;
     bool validPrimitive = false;
     // normal | <number> | <length> | <percentage> | inherit
     if (id == CSSValueNormal)
         validPrimitive = true;
     else
         validPrimitive = (!id && validUnit(value, FNumber | FLength | FPercent | FNonNeg));
+    // The line-height property can accept both percents and numbers but additive opertaions are
+    // not permitted on them in calc() expressions.
+    if (m_parsedCalculation && m_parsedCalculation->category() == CalcPercentNumber)
+        validPrimitive = false;

[alancutter (OOO until 2018), 2014/12/31 03:38:08]

You should release() m_parsedCalulation here if it's no longer going to be
consumed by parseValidPrimitive().

     if (validPrimitive && (!m_valueList->next() || inShorthand()))
         addProperty(CSSPropertyLineHeight, parseValidPrimitive(id, value), important);
     return validPrimitive;
 }
 
 bool CSSPropertyParser::parseFontSize(bool important)
 {
     CSSParserValue* value = m_valueList->current();
     CSSValueID id = value->id;
     bool validPrimitive = false;
@@ skipping 3853 matching lines @@
         }
     }
 
     if (!list->length())
         return nullptr;
 
     return list.release();
 }
 
 } // namespace blink