19723 2008-06-23 05:47:28 -0700 REGRESSION(r34648): Some SVG tests crash when running under --threaded 2008-06-24 05:36:26 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) All All RESOLVED FIXED P1 Normal --- 1 ap webkit-unassigned oldest_to_newest 84129 0 ap 2008-06-23 05:47:28 -0700 In <http://trac.webkit.org/changeset/34648>, painting was added to RenderSVGInlineText::destroy(). During document destruction, rendering structures are not kept in consistent state, and painting results in access to freed memory (possibly overwritten by a background thread). I have a fix that wraps painting in if (!documentBeingDestroyed()), but given that no other destroy() call paints itself, it might be that the original bug could/should be fixed in some different manner. 84130 1 21880 ap 2008-06-23 06:08:25 -0700 Created attachment 21880 naive fix Rob is going to look into whether painting inside destroy() is needed at all, but since I already had a fix for the crashes, I'm attaching it for now. 84149 2 21880 darin 2008-06-23 09:56:18 -0700 Comment on attachment 21880 naive fix r=me 84242 3 ap 2008-06-24 05:36:26 -0700 Committed my (hopefully, temporary) fix in revision 34766. 21880 2008-06-23 06:08:25 -0700 2008-06-23 09:56:18 -0700 naive fix 19723_patch.txt text/plain 1275 ap SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiAzNDczNykKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTQgQEAKKzIwMDgtMDYtMjMgIEFsZXhleSBQcm9za3VyeWFrb3YgIDxhcEB3ZWJr aXQub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xOTcyMworICAgICAgICBS RUdSRVNTSU9OKHIzNDY0OCk6IFNvbWUgU1ZHIHRlc3RzIGNyYXNoIHdoZW4gcnVubmluZyB1bmRl ciAtLXRocmVhZGVkCisKKyAgICAgICAgKiByZW5kZXJpbmcvUmVuZGVyU1ZHSW5saW5lVGV4dC5j cHA6IChXZWJDb3JlOjpSZW5kZXJTVkdJbmxpbmVUZXh0OjpkZXN0cm95KTogRG8gbm90IGF0dGVt cHQKKyAgICAgICAgdG8gcGFpbnQgZHVyaW5nIGRvY3VtZW50IGRlc3RydWN0aW9uLCBiZWNhdXNl IHJlbmRlcmluZyBzdHJ1Y3R1cmVzIGFyZSBub3Qga2VwdCBpbiBhCisgICAgICAgIGNvbnNpc3Rl bnQgc3RhdGUgdGhlbi4KKwogMjAwOC0wNi0yMyAgQWxleGV5IFByb3NrdXJ5YWtvdiAgPGFwQHdl YmtpdC5vcmc+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgTWFyayBSb3dlLgpJbmRleDogV2ViQ29y ZS9yZW5kZXJpbmcvUmVuZGVyU1ZHSW5saW5lVGV4dC5jcHAKPT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29y ZS9yZW5kZXJpbmcvUmVuZGVyU1ZHSW5saW5lVGV4dC5jcHAJKHJldmlzaW9uIDM0NzM2KQorKysg V2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyU1ZHSW5saW5lVGV4dC5jcHAJKHdvcmtpbmcgY29weSkK QEAgLTE2Miw4ICsxNjIsMTAgQEAgVmlzaWJsZVBvc2l0aW9uIFJlbmRlclNWR0lubGluZVRleHQ6 OnBvcwogCiB2b2lkIFJlbmRlclNWR0lubGluZVRleHQ6OmRlc3Ryb3koKQogewotICAgIHNldE5l ZWRzTGF5b3V0QW5kUHJlZldpZHRoc1JlY2FsYygpOwotICAgIHJlcGFpbnQoKTsKKyAgICBpZiAo IWRvY3VtZW50QmVpbmdEZXN0cm95ZWQoKSkgeworICAgICAgICBzZXROZWVkc0xheW91dEFuZFBy ZWZXaWR0aHNSZWNhbGMoKTsKKyAgICAgICAgcmVwYWludCgpOworICAgIH0KICAgICBSZW5kZXJU ZXh0OjpkZXN0cm95KCk7CiB9CiAK