Bug 11404 – REGRESSION: Reproducible assertion failure in Shared<WebCore::StringImpl>::ref() running svg/custom/svg/custom/gradient-attr-update.svg

• Status: RESOLVED
• Resolution: FIXED
• Component: SVG

[Geoffrey Garen]

The assertion failure is intermittent in debug runs of the layout tests. You can reproduce it reliably by forcing DumpRenderTree to do many runs, like so:

run-webkit-tests --verbose svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom svg/custom

You can use the same trick when running DRT in the debugger.

Date/Time:      2006-10-24 10:49:33.551 -0700
OS Version:     10.4.8 (Build 8L2127)
Report Version: 4

Command: DumpRenderTree
Path:    /Users/ggaren/symroots/Debug/DumpRenderTree
Parent:  perl [8204]

Version: ??? (???)

PID:    8248
Thread: 0

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0xbbadbeef

Thread 0 Crashed:
0   com.apple.WebCore        	0x01450ed8 WebCore::Shared<WebCore::StringImpl>::ref() + 70 (Shared.h:41)
1   com.apple.WebCore        	0x01450f1b WTF::RefPtr<WebCore::StringImpl>::RefPtr[in-charge](WTF::RefPtr<WebCore::StringImpl> const&) + 41 (RefPtr.h:37)
2   com.apple.WebCore        	0x01451004 WebCore::String::String[in-charge](WebCore::String const&) + 24 (PlatformString.h:51)
3   com.apple.WebCore        	0x010aae50 WebCore::SVGPaint::uri() const + 30 (SVGPaint.cpp:74)
4   com.apple.WebCore        	0x0107018c WebCore::StyleFillData::operator==(WebCore::StyleFillData const&) const + 212 (SVGRenderStyleDefs.cpp:62)
5   com.apple.WebCore        	0x01472576 WebCore::DataRef<WebCore::StyleFillData>::operator==(WebCore::DataRef<WebCore::StyleFillData> const&) const + 166 (DataRef.h:87)
6   com.apple.WebCore        	0x0106f104 WebCore::SVGRenderStyle::operator==(WebCore::SVGRenderStyle const&) const + 30 (SVGRenderStyle.cpp:90)
7   com.apple.WebCore        	0x014e10e0 WebCore::DataRef<WebCore::SVGRenderStyle>::operator==(WebCore::DataRef<WebCore::SVGRenderStyle> const&) const + 166 (DataRef.h:87)
8   com.apple.WebCore        	0x011b765c WebCore::RenderStyle::operator==(WebCore::RenderStyle const&) const + 314 (RenderStyle.cpp:691)
9   com.apple.WebCore        	0x0125d688 WebCore::Node::diff(WebCore::RenderStyle*, WebCore::RenderStyle*) const + 244 (Node.cpp:647)
10  com.apple.WebCore        	0x01263413 WebCore::Element::recalcStyle(WebCore::Node::StyleChange) + 235 (Element.cpp:579)
11  com.apple.WebCore        	0x0126363f WebCore::Element::recalcStyle(WebCore::Node::StyleChange) + 791 (Element.cpp:616)
12  com.apple.WebCore        	0x01113514 WebCore::Document::recalcStyle(WebCore::Node::StyleChange) + 1074 (Document.cpp:873)
13  com.apple.WebCore        	0x0110c95b WebCore::Document::updateRendering() + 49 (Document.cpp:898)
14  com.apple.WebCore        	0x01110270 WebCore::Document::updateDocumentsRendering() + 56 (Document.cpp:905)
15  com.apple.WebCore        	0x01279007 KJS::JSAbstractEventListener::handleEvent(WebCore::Event*, bool) + 1365 (kjs_events.cpp:144)
16  com.apple.WebCore        	0x012454f0 WebCore::EventTargetNode::handleLocalEvents(WebCore::Event*, bool) + 352 (EventTargetNode.cpp:162)
17  com.apple.WebCore        	0x01245ba8 WebCore::EventTargetNode::dispatchGenericEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool) + 968 (EventTargetNode.cpp:214)
18  com.apple.WebCore        	0x0124671e WebCore::EventTargetNode::dispatchEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool) + 290 (EventTargetNode.cpp:292)
19  com.apple.WebCore        	0x01246fc9 WebCore::EventTargetNode::dispatchMouseEvent(WebCore::AtomicString const&, int, int, int, int, int, int, bool, bool, bool, bool, bool, WebCore::Node*) + 545 (EventTargetNode.cpp:418)
20  com.apple.WebCore        	0x01247474 WebCore::EventTargetNode::dispatchMouseEvent(WebCore::PlatformMouseEvent const&, WebCore::AtomicString const&, int, WebCore::Node*) + 364 (EventTargetNode.cpp:376)
21  com.apple.WebCore        	0x011089f9 WebCore::FrameView::dispatchMouseEvent(WebCore::AtomicString const&, WebCore::Node*, bool, int, WebCore::PlatformMouseEvent const&, bool) + 567 (FrameView.cpp:1191)
22  com.apple.WebCore        	0x01108e18 WebCore::FrameView::handleMouseReleaseEvent(WebCore::PlatformMouseEvent const&) + 582 (FrameView.cpp:900)
23  com.apple.WebCore        	0x010f6518 WebCore::FrameMac::mouseUp(NSEvent*) + 450 (FrameMac.mm:2031)
24  com.apple.WebCore        	0x011218cf -[WebCoreFrameBridge mouseUp:] + 27 (WebCoreFrameBridge.mm:1083)
25  com.apple.WebKit         	0x0024bb8c -[WebHTMLView mouseUp:] + 239 (WebHTMLView.m:2958)
26  DumpRenderTree           	0x00003512 -[EventSendingController mouseUp] + 426 (EventSendingController.m:184)
27  libobjc.A.dylib          	0x90a56c56 objc_msgSendv + 54
28  com.apple.Foundation     	0x925fc43e -[NSInvocation invoke] + 932
29  com.apple.JavaScriptCore 	0x1e8a5942 KJS::Bindings::ObjcInstance::invokeMethod(KJS::ExecState*, KJS::Bindings::MethodList const&, KJS::List const&) + 1628 (objc_instance.mm:209)
30  com.apple.JavaScriptCore 	0x1e8a0ff7 KJS::RuntimeMethod::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 227 (runtime_method.cpp:88)
31  com.apple.JavaScriptCore 	0x1e882ab0 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 210 (object.cpp:96)
32  com.apple.JavaScriptCore 	0x1e87893b KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 843 (nodes.cpp:772)
33  com.apple.JavaScriptCore 	0x1e875b58 KJS::ExprStatementNode::execute(KJS::ExecState*) + 148 (nodes.cpp:1672)
34  com.apple.JavaScriptCore 	0x1e873886 KJS::SourceElementsNode::execute(KJS::ExecState*) + 566 (nodes.cpp:2455)
35  com.apple.JavaScriptCore 	0x1e872088 KJS::BlockNode::execute(KJS::ExecState*) + 140 (nodes.cpp:1648)
36  com.apple.JavaScriptCore 	0x1e875a4c KJS::IfNode::execute(KJS::ExecState*) + 420 (nodes.cpp:1691)
37  com.apple.JavaScriptCore 	0x1e873750 KJS::SourceElementsNode::execute(KJS::ExecState*) + 256 (nodes.cpp:2449)
38  com.apple.JavaScriptCore 	0x1e872088 KJS::BlockNode::execute(KJS::ExecState*) + 140 (nodes.cpp:1648)
39  com.apple.JavaScriptCore 	0x1e863da2 KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 50 (function.cpp:331)
40  com.apple.JavaScriptCore 	0x1e866085 KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 573 (function.cpp:108)
41  com.apple.JavaScriptCore 	0x1e882ab0 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 210 (object.cpp:96)
42  com.apple.JavaScriptCore 	0x1e8790bc KJS::FunctionCallResolveNode::evaluate(KJS::ExecState*) + 716 (nodes.cpp:679)
43  com.apple.JavaScriptCore 	0x1e875b58 KJS::ExprStatementNode::execute(KJS::ExecState*) + 148 (nodes.cpp:1672)
44  com.apple.JavaScriptCore 	0x1e873750 KJS::SourceElementsNode::execute(KJS::ExecState*) + 256 (nodes.cpp:2449)
45  com.apple.JavaScriptCore 	0x1e872088 KJS::BlockNode::execute(KJS::ExecState*) + 140 (nodes.cpp:1648)
46  com.apple.JavaScriptCore 	0x1e86b4e1 KJS::Interpreter::evaluate(KJS::UString const&, int, KJS::UChar const*, int, KJS::JSValue*) + 977 (interpreter.cpp:475)
47  com.apple.WebCore        	0x0128493b WebCore::KJSProxy::evaluate(WebCore::String const&, int, WebCore::String const&, WebCore::Node*) + 319 (kjs_proxy.cpp:68)
48  com.apple.WebCore        	0x010f1ff3 WebCore::Frame::executeScript(WebCore::Node*, WebCore::String const&, bool) + 185 (Frame.cpp:669)
49  com.apple.WebCore        	0x0128b83f KJS::ScheduledAction::execute(KJS::Window*) + 803 (kjs_window.cpp:1848)
50  com.apple.WebCore        	0x0128e152 KJS::Window::timerFired(KJS::DOMWindowTimer*) + 402 (kjs_window.cpp:1965)
51  com.apple.WebCore        	0x0128e1a9 KJS::DOMWindowTimer::fired() + 47 (kjs_window.cpp:2511)
52  com.apple.WebCore        	0x0122806a WebCore::TimerBase::fireTimers(double, WTF::Vector<WebCore::TimerBase*, (unsigned long)0> const&) + 196 (Timer.cpp:322)
53  com.apple.WebCore        	0x01228107 WebCore::TimerBase::sharedTimerFired() + 109 (Timer.cpp:355)
54  com.apple.WebCore        	0x012277be WebCore::timerFired(__CFRunLoopTimer*, void*) + 22 (SharedTimerMac.cpp:47)
55  com.apple.CoreFoundation 	0x90828bc9 CFRunLoopRunSpecific + 3341
56  com.apple.CoreFoundation 	0x90827eb5 CFRunLoopRunInMode + 61
57  com.apple.Foundation     	0x9262adc6 -[NSRunLoop runMode:beforeDate:] + 182
58  DumpRenderTree           	0x00008c4f runTest + 935 (DumpRenderTree.m:999)
59  DumpRenderTree           	0x00005cc7 main + 3341 (DumpRenderTree.m:354)
60  DumpRenderTree           	0x00002426 _start + 216
61  DumpRenderTree           	0x0000234d start + 41

Thread 1:
0   libSystem.B.dylib        	0x90009857 mach_msg_trap + 7
1   com.apple.CoreFoundation 	0x9082869a CFRunLoopRunSpecific + 2014
2   com.apple.CoreFoundation 	0x90827eb5 CFRunLoopRunInMode + 61
3   com.apple.Foundation     	0x92651c4e +[NSURLCache _diskCacheSyncLoop:] + 206
4   com.apple.Foundation     	0x925f536c forkThreadForFunction + 123
5   libSystem.B.dylib        	0x90023d87 _pthread_body + 84

Thread 2:
0   libSystem.B.dylib        	0x90009857 mach_msg_trap + 7
1   com.apple.CoreFoundation 	0x9082869a CFRunLoopRunSpecific + 2014
2   com.apple.CoreFoundation 	0x90827eb5 CFRunLoopRunInMode + 61
3   com.apple.Foundation     	0x9262aa9b +[NSURLConnection(NSURLConnectionInternal) _resourceLoadLoop:] + 259
4   com.apple.Foundation     	0x925f536c forkThreadForFunction + 123
5   libSystem.B.dylib        	0x90023d87 _pthread_body + 84

Thread 0 crashed with X86 Thread State (32-bit):
  eax: 0xbbadbeef    ebx: 0x01450e9e ecx: 0xa0001e60 edx: 0x00000000
  edi: 0x00000000    esi: 0xbfffd6ac ebp: 0xbfffd608 esp: 0xbfffd5f0
   ss: 0x0000001f    efl: 0x00010286 eip: 0x01450ed8  cs: 0x00000017
   ds: 0x0000001f     es: 0x0000001f  fs: 0x00000000  gs: 0x00000037

Binary Images Description:
    0x1000 -     0xefff DumpRenderTree 	/Users/ggaren/symroots/Debug/DumpRenderTree
  0x205000 -   0x2c7fff com.apple.WebKit 420+	/Users/ggaren/symroots/Debug/WebKit.framework/Versions/A/WebKit
 0x1008000 -  0x1591fff com.apple.WebCore 420+	/Users/ggaren/symroots/Debug/WebCore.framework/Versions/A/WebCore
0x1e855000 - 0x1e900fff com.apple.JavaScriptCore 420+	/Users/ggaren/symroots/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore
0x8fe00000 - 0x8fe49fff dyld 46.9	/usr/lib/dyld
0x90000000 - 0x9016ffff libSystem.B.dylib 	/usr/lib/libSystem.B.dylib
0x901bf000 - 0x901c1fff libmathCommon.A.dylib 	/usr/lib/system/libmathCommon.A.dylib
0x901c3000 - 0x901fffff com.apple.CoreText 1.1.1 (???)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreText.framework/Versions/A/CoreText
0x90226000 - 0x902fbfff ATS 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/ATS
0x9031b000 - 0x9076ffff com.apple.CoreGraphics 1.258.38 (???)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
0x90806000 - 0x908cefff com.apple.CoreFoundation 6.4.6 (368.27)	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
0x9090c000 - 0x9090cfff com.apple.CoreServices 10.4 (???)	/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices
0x9090e000 - 0x90a01fff libicucore.A.dylib 	/usr/lib/libicucore.A.dylib
0x90a51000 - 0x90ad0fff libobjc.A.dylib 	/usr/lib/libobjc.A.dylib
0x90af9000 - 0x90b5dfff libstdc++.6.dylib 	/usr/lib/libstdc++.6.dylib
0x90bcc000 - 0x90bd3fff libgcc_s.1.dylib 	/usr/lib/libgcc_s.1.dylib
0x90bd8000 - 0x90c4bfff com.apple.framework.IOKit 1.4.6 (???)	/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
0x90c60000 - 0x90c72fff libauto.dylib 	/usr/lib/libauto.dylib
0x90c78000 - 0x90f1efff com.apple.CoreServices.CarbonCore 682.15	/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore
0x90f61000 - 0x90fc9fff com.apple.CoreServices.OSServices 4.1	/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices
0x91001000 - 0x9103ffff com.apple.CFNetwork 129.18	/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CFNetwork.framework/Versions/A/CFNetwork
0x91052000 - 0x91062fff com.apple.WebServices 1.1.3 (1.1.0)	/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/WebServicesCore.framework/Versions/A/WebServicesCore
0x9106d000 - 0x910ebfff com.apple.SearchKit 1.0.5	/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit
0x91120000 - 0x9113efff com.apple.Metadata 10.4.4 (121.36)	/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Metadata
0x9114a000 - 0x91158fff libz.1.dylib 	/usr/lib/libz.1.dylib
0x9115b000 - 0x912fafff com.apple.security 4.5.1 (29002)	/System/Library/Frameworks/Security.framework/Versions/A/Security
0x913f8000 - 0x91400fff com.apple.DiskArbitration 2.1.1	/System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration
0x91407000 - 0x9142dfff com.apple.SystemConfiguration 1.8.6	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
0x9143f000 - 0x91446fff libbsm.dylib 	/usr/lib/libbsm.dylib
0x9144a000 - 0x914c3fff com.apple.audio.CoreAudio 3.0.4	/System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio
0x91511000 - 0x91511fff com.apple.ApplicationServices 10.4 (???)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices
0x91513000 - 0x9153efff com.apple.AE 314 (313)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE
0x91551000 - 0x91625fff com.apple.ColorSync 4.4.8	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ColorSync.framework/Versions/A/ColorSync
0x91660000 - 0x916ddfff com.apple.print.framework.PrintCore 4.6 (177.13)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/PrintCore.framework/Versions/A/PrintCore
0x9170a000 - 0x917b3fff com.apple.QD 3.10.21 (???)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/QD.framework/Versions/A/QD
0x917d9000 - 0x91824fff com.apple.HIServices 1.5.2 (???)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/HIServices.framework/Versions/A/HIServices
0x91843000 - 0x91859fff com.apple.LangAnalysis 1.6.3	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LangAnalysis.framework/Versions/A/LangAnalysis
0x91865000 - 0x9187ffff com.apple.FindByContent 1.5	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/FindByContent.framework/Versions/A/FindByContent
0x91889000 - 0x918c6fff com.apple.LaunchServices 181	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices
0x918da000 - 0x918e6fff com.apple.speech.synthesis.framework 3.5	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/SpeechSynthesis.framework/Versions/A/SpeechSynthesis
0x918ed000 - 0x91928fff com.apple.ImageIO.framework 1.5.0	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/ImageIO
0x9193a000 - 0x919ecfff libcrypto.0.9.7.dylib 	/usr/lib/libcrypto.0.9.7.dylib
0x91a32000 - 0x91a48fff libcups.2.dylib 	/usr/lib/libcups.2.dylib
0x91a4d000 - 0x91a6bfff libJPEG.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libJPEG.dylib
0x91a70000 - 0x91acefff libJP2.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libJP2.dylib
0x91ae0000 - 0x91ae4fff libGIF.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libGIF.dylib
0x91ae6000 - 0x91b63fff libRaw.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libRaw.dylib
0x91b67000 - 0x91ba4fff libTIFF.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libTIFF.dylib
0x91baa000 - 0x91bc4fff libPng.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib
0x91bc9000 - 0x91bcbfff libRadiance.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libRadiance.dylib
0x91bcd000 - 0x91bcdfff com.apple.Accelerate 1.3.1 (Accelerate 1.3.1)	/System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate
0x91bcf000 - 0x91c5dfff com.apple.vImage 2.5	/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vImage.framework/Versions/A/vImage
0x91c64000 - 0x91c64fff com.apple.Accelerate.vecLib 3.3.1 (vecLib 3.3.1)	/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/vecLib
0x91c66000 - 0x91cbffff libvMisc.dylib 	/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvMisc.dylib
0x91cc8000 - 0x91cecfff libvDSP.dylib 	/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvDSP.dylib
0x91cf4000 - 0x920fdfff libBLAS.dylib 	/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libBLAS.dylib
0x92137000 - 0x924ebfff libLAPACK.dylib 	/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLAPACK.dylib
0x92518000 - 0x9259cfff com.apple.DesktopServices 1.3.4	/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv
0x925d8000 - 0x92808fff com.apple.Foundation 6.4.7 (567.28)	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
0x92914000 - 0x929f2fff libxml2.2.dylib 	/usr/lib/libxml2.2.dylib
0x92a0f000 - 0x92afcfff libiconv.2.dylib 	/usr/lib/libiconv.2.dylib
0x92b0c000 - 0x92b23fff libGL.dylib 	/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib
0x92b2e000 - 0x92b86fff libGLU.dylib 	/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLU.dylib
0x92b9a000 - 0x92b9afff com.apple.Carbon 10.4 (???)	/System/Library/Frameworks/Carbon.framework/Versions/A/Carbon
0x92b9c000 - 0x92bacfff com.apple.ImageCapture 3.0.4	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/ImageCapture.framework/Versions/A/ImageCapture
0x92bba000 - 0x92bc2fff com.apple.speech.recognition.framework 3.6	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SpeechRecognition.framework/Versions/A/SpeechRecognition
0x92bc8000 - 0x92bcdfff com.apple.securityhi 2.0.1 (24742)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SecurityHI.framework/Versions/A/SecurityHI
0x92bd3000 - 0x92c64fff com.apple.ink.framework 101.2.1 (71)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ink.framework/Versions/A/Ink
0x92c78000 - 0x92c7bfff com.apple.help 1.0.3 (32.1)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Help.framework/Versions/A/Help
0x92c7e000 - 0x92c9bfff com.apple.openscripting 1.2.5 (???)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/OpenScripting.framework/Versions/A/OpenScripting
0x92cab000 - 0x92cb1fff com.apple.print.framework.Print 5.2 (192.4)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Print.framework/Versions/A/Print
0x92cb7000 - 0x92d1afff com.apple.htmlrendering 66.1 (1.1.3)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HTMLRendering.framework/Versions/A/HTMLRendering
0x92d3e000 - 0x92d7ffff com.apple.NavigationServices 3.4.4 (3.4.3)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/NavigationServices.framework/Versions/A/NavigationServices
0x92da6000 - 0x92db3fff com.apple.audio.SoundManager 3.9.1	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CarbonSound.framework/Versions/A/CarbonSound
0x92dba000 - 0x92dbffff com.apple.CommonPanels 1.2.3 (73)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CommonPanels.framework/Versions/A/CommonPanels
0x92dc4000 - 0x930b6fff com.apple.HIToolbox 1.4.8 (???)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox
0x931bb000 - 0x931c6fff com.apple.opengl 1.4.12	/System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL
0x93256000 - 0x93256fff com.apple.Cocoa 6.4 (???)	/System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa
0x93258000 - 0x9390efff com.apple.AppKit 6.4.8 (824.42)	/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
0x93c8f000 - 0x93d09fff com.apple.CoreData 90	/System/Library/Frameworks/CoreData.framework/Versions/A/CoreData
0x93d42000 - 0x93e03fff com.apple.audio.toolbox.AudioToolbox 1.4.3	/System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox
0x93e43000 - 0x93e43fff com.apple.audio.units.AudioUnit 1.4.2	/System/Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit
0x93e45000 - 0x94017fff com.apple.QuartzCore 1.4.9	/System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore
0x94068000 - 0x940a9fff libsqlite3.0.dylib 	/usr/lib/libsqlite3.0.dylib
0x940b1000 - 0x940ebfff libGLImage.dylib 	/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dylib
0x94271000 - 0x94280fff libCGATS.A.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCGATS.A.dylib
0x94287000 - 0x94292fff libCSync.A.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCSync.A.dylib
0x94297000 - 0x942bbfff libPDFRIP.A.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libPDFRIP.A.dylib
0x942de000 - 0x942f8fff libRIP.A.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libRIP.A.dylib
0x95742000 - 0x95765fff libxslt.1.dylib 	/usr/lib/libxslt.1.dylib
0x9707b000 - 0x97080fff com.apple.agl 2.5.9 (AGL-2.5.9)	/System/Library/Frameworks/AGL.framework/Versions/A/AGL

Model: MacBookPro1,1, BootROM MBP11.0055.B03, 2 processors, Intel Core Duo, 2.16 GHz, 2 GB
Graphics: ATI Radeon X1600, ATY,RadeonX1600, PCIe, 256 MB
Memory Module: BANK 0/DIMM0, 1 GB, DDR2 SDRAM, 667 MHz
Memory Module: BANK 1/DIMM1, 1 GB, DDR2 SDRAM, 667 MHz
AirPort: spairport_wireless_card_type_airport_extreme (0x168C, 0x86), 0.1.27
Bluetooth: Version 1.7.9f12, 2 service, 0 devices, 1 incoming serial ports
Network Service: AirPort, AirPort, en1
Serial ATA Device: ST9100824AS, 93.16 GB
Parallel ATA Device: MATSHITADVD-R   UJ-857
USB Device: Built-in iSight, Micron, Up to 480 Mb/sec, 500 mA
USB Device: Apple Internal Keyboard / Trackpad, Apple Computer, Up to 12 Mb/sec, 500 mA
USB Device: IR Receiver, Apple Computer, Inc., Up to 12 Mb/sec, 500 mA
USB Device: Bluetooth HCI, Up to 12 Mb/sec, 500 mA

[Geoffrey Garen]

ASSERTION FAILED: !m_inDestructor
(/Users/ggaren/Labyrinth/OpenSource/WebCore/platform/Shared.h:41 void WebCore::Shared<T>::ref() [with T = WebCore::StringImpl])

m_inDestructor and m_refCount are garbage, so the assertion is only accidentally correct.

[Geoffrey Garen]

*** Bug 11403 has been marked as a duplicate of this bug. ***

[Geoffrey Garen]

StyleFillData.paint has been destroyed. Sounds like a case for RefPtr.

[Darin Adler]

Looks to me like the root of the problem is that StyleFillData has a SVGPaint* instead of RefPtr<SVGPaint>. I don't get how the classes in SVGRenderStyleDefs.h (e.g. StyleStrokeData) can go without reference counting.

[Geoffrey Garen]

Created attachment 11196 [details]
fix

[Anders Carlsson]

Comment on attachment 11196 [details]
fix

r=me

[Geoffrey Garen]

Committed revision 17272.