33495 2010-01-11 14:58:28 -0800 svg/dynamic-updates tests sometimes crash on Windows Release Bot 2011-03-03 06:21:54 -0800 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) PC Windows XP RESOLVED FIXED InRadar, LayoutTestFailure, PlatformOnly P1 Normal --- 33305 1 eric webkit-unassigned aroben zimmermann oldest_to_newest 179561 0 eric 2010-01-11 14:58:28 -0800 svg/dynamic-updates/SVGRectElement-svgdom-x-prop.html crashed on Windows Release Bot http://build.webkit.org/results/Windows%20Release%20(Tests)/r53099%20(7813)/results.html Unfortunately I have no way to get a crash log for you. This bug can be used for tracking though in case we ever see this again. 193063 1 eric 2010-02-23 12:07:55 -0800 *** Bug 34732 has been marked as a duplicate of this bug. *** 193064 2 eric 2010-02-23 12:08:39 -0800 See a duplicated bug about svg/dynamic-updates/SVGLineElement-svgdom-y2-prop.html. The bots also just saw: svg/dynamic-updates/SVGRadialGradientElement-svgdom-fy-prop.html crash: http://build.webkit.org/results/Windows%20Release%20(Tests)/r55161%20(9366)/results.html 193067 3 eric 2010-02-23 12:10:49 -0800 Someone with a windows box should ideally try: run-webkit-tests svg/dynamic-updates --iterations=1000 and see if it crashes (so we can get a back-trace). 213768 4 aroben 2010-04-18 09:25:21 -0700 *** Bug 37339 has been marked as a duplicate of this bug. *** 213769 5 aroben 2010-04-18 09:26:53 -0700 A few other tests have been crashing recently: svg/dynamic-updates/SVGMaskElement-svgdom-x-prop.html <http://build.webkit.org/results/Windows%20Release%20(Tests)/r57792%20(11412)/results.html> svg/dynamic-updates/SVGLineElement-svgdom-x2-prop.html <http://build.webkit.org/results/Windows%20Release%20(Tests)/r57791%20(11411)/results.html> svg/dynamic-updates/SVGMarkerElement-svgdom-refX-prop.html <http://build.webkit.org/results/Windows%20Release%20(Tests)/r57790%20(11410)/results.html> svg/dynamic-updates/SVGLinearGradientElement-svgdom-x1-prop.html svg/dynamic-updates/SVGRectElement-svgdom-width-prop.html <http://build.webkit.org/results/Windows%20Release%20(Tests)/r57788%20(11408)/results.html> 213775 6 aroben 2010-04-18 09:38:50 -0700 <rdar://problem/7877403> 214064 7 aroben 2010-04-19 09:37:17 -0700 svg/dynamic-updates/SVGRadialGradientElement-svgdom-fx-prop.html: <http://build.webkit.org/results/Windows%20Release%20(Tests)/r57810%20(11431)/results.html> 214844 8 aroben 2010-04-20 12:17:59 -0700 I tried running the dynamic-updates tests on Debug and couldn't get a crash. Then I ran them on Release and got a crash pretty quickly. Here's the backtrace: 075f3bbf() > WebKit.dll!WebCore::jsSVGLengthValueAsString(JSC::ExecState * exec=, JSC::JSValue slotBase={...}, const JSC::Identifier & __formal=) Line 218 + 0x14 bytes C++ WebKit.dll!WebCore::JSSVGLength::getOwnPropertySlot(JSC::ExecState * exec=0x0012e9c0, const JSC::Identifier & propertyName={...}, JSC::PropertySlot & slot={...}) Line 182 + 0x15 bytes C++ JavaScriptCore.dll!JSC::JSValue::get(JSC::ExecState * exec=0x037b0188, const JSC::Identifier & propertyName={...}, JSC::PropertySlot & slot={...}) Line 633 + 0x34 bytes C++ JavaScriptCore.dll!cti_op_get_by_id(void * * args=0x00000000) Line 1465 C++ JavaScriptCore.dll!JSC::Interpreter::execute(JSC::EvalExecutable * eval=0x7f0b3690, JSC::ExecState * callFrame=0x037b0110, JSC::JSObject * thisObj=0x03bc0000, int globalRegisterOffset=49, JSC::ScopeChainNode * scopeChain=0x7ff20930, JSC::JSValue * exception=0x0012ebe8) Line 854 C++ JavaScriptCore.dll!JSC::Interpreter::callEval(JSC::ExecState * callFrame=0x00000000, JSC::RegisterFile * registerFile=0x7fef32dc, JSC::Register * argv=0x037b0138, int argc=58392576, int registerOffset=15, JSC::JSValue & exceptionValue={...}) Line 316 + 0x63 bytes C++ JavaScriptCore.dll!cti_op_call_eval(void * * args=0x00000000) Line 2903 C++ JavaScriptCore.dll!JSC::Interpreter::execute(JSC::ProgramExecutable * program=0x7f0b30e0, JSC::ExecState * callFrame=0x7fcb4068, JSC::ScopeChainNode * scopeChain=0x7fa1de10, JSC::JSObject * thisObj=0x03bc0000, JSC::JSValue * exception=0x0012ecd8) Line 626 C++ JavaScriptCore.dll!JSC::evaluate(JSC::ExecState * exec=, JSC::ScopeChain & scopeChain=, const JSC::SourceCode & source=, JSC::JSValue thisValue={...}) Line 65 C++ WebKit.dll!WebCore::ScriptController::windowShell(WebCore::DOMWrapperWorld * world=0x0000003f) Line 85 + 0x14 bytes C++ 00000040() 214845 9 aroben 2010-04-20 12:19:09 -0700 The backtrace in comment 8 occurred when running both SVGLinearGradientElement-svgdom-y1-prop.html and SVGLinearGradientElement-svgdom-x1-prop.html. 214851 10 aroben 2010-04-20 12:21:18 -0700 Got a slightly different backtrace when I ran under the debugger (rather than attaching the debugger at the time of the crash). This was for SVGEllipseElement-svgdom-rx-prop.html: JavaScriptCore.dll!JSC::UStringImpl::createUninitialized(unsigned int length=2142638116, wchar_t * & data=) + 0x395de bytes C++ WebKit.dll!WebCore::CachedScriptSourceProvider::getRange(int start=1239560, int end=1239488) Line 46 + 0x2c bytes C++ > WebKit.dll!WebCore::JSSVGLength::value(JSC::ExecState * exec=0x1003e2f8) Line 34 + 0xe bytes C++ JavaScriptCore.dll!JSC::JSValue::get(JSC::ExecState * exec=0x037b0120, const JSC::Identifier & propertyName={...}, JSC::PropertySlot & slot={...}) Line 633 + 0x34 bytes C++ JavaScriptCore.dll!cti_op_get_by_id(void * * args=0x00000000) Line 1465 C++ JavaScriptCore.dll!JSC::Interpreter::execute(JSC::EvalExecutable * eval=0x7f068af0, JSC::ExecState * callFrame=0x037b00a8, JSC::JSObject * thisObj=0x03bc0000, int globalRegisterOffset=36, JSC::ScopeChainNode * scopeChain=0x7fd80378, JSC::JSValue * exception=0x0012ebe8) Line 854 C++ JavaScriptCore.dll!JSC::Interpreter::callEval(JSC::ExecState * callFrame=0x00000000, JSC::RegisterFile * registerFile=0x7fef32dc, JSC::Register * argv=0x037b00d0, int argc=58392576, int registerOffset=15, JSC::JSValue & exceptionValue={...}) Line 316 + 0x63 bytes C++ JavaScriptCore.dll!cti_op_call_eval(void * * args=0x00000000) Line 2903 C++ JavaScriptCore.dll!JSC::Interpreter::execute(JSC::ProgramExecutable * program=0x7f077fc0, JSC::ExecState * callFrame=0x7fede968, JSC::ScopeChainNode * scopeChain=0x7fc77d68, JSC::JSObject * thisObj=0x03bc0000, JSC::JSValue * exception=0x0012ecd8) Line 626 C++ JavaScriptCore.dll!JSC::evaluate(JSC::ExecState * exec=, JSC::ScopeChain & scopeChain=, const JSC::SourceCode & source=, JSC::JSValue thisValue={...}) Line 65 C++ WebKit.dll!WebCore::ScriptController::windowShell(WebCore::DOMWrapperWorld * world=0x0000003f) Line 85 + 0x14 bytes C++ 00000040() 214854 11 aroben 2010-04-20 12:22:31 -0700 Turning on full page heap doesn't change the backtrace. 248987 12 zimmermann 2010-07-09 07:19:32 -0700 Changed component to SVG, so it shows up in my all-svg-bugs search. 361556 13 aroben 2011-03-03 06:21:54 -0800 We haven't seen this on the bots in a while, and we are running these tests. I guess it's gone!