48979 2010-11-03 23:47:22 -0700 [Chromium] SVGListPropertyTearOff.h: function commitChange ASSERTs on Win & Mac 2010-11-05 02:43:03 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) PC OS X 10.5 RESOLVED FIXED LayoutTestFailure P2 Normal --- 47905 1 rolandsteiner webkit-unassigned commit-queue mdelaney7 zimmermann oldest_to_newest 304495 0 rolandsteiner 2010-11-03 23:47:22 -0700 The function commitChange() in SVGListPropertyTearOff.h started to run into " ASSERT(size == values.size()); " on Chromium Windows and Mac (at least), sometimes between WK r71224 and r71305. The failed condition seems to have no adverse effect in Release (where the ASSERT isn't run), but it still seems fishy: 'values' has 1 entry, while 'wrappers' has 2, with the first entry being NULL. 304519 1 zimmermann 2010-11-04 00:57:11 -0700 I'll investigate today. 304694 2 zimmermann 2010-11-04 09:02:01 -0700 Interessting, the garbage collection in v8 is freeing the SVGPropertyTearOff wrapper earlier than JSC, and thanks to that I found the bug: PassListItemTearOff removeItemValuesAndWrappers(AnimatedListPropertyTearOff* animatedList, unsigned index, ExceptionCode& ec) { .... // Detach the existing wrapper. RefPtr<ListItemTearOff>& oldItem = wrappers.at(index); if (oldItem) { oldItem->detachWrapper(); wrappers.remove(index); } The wrappers.remove(index) needs to be moved out of the if clause, otherwhise the list sizes don't match. Unfortunately I need to leave now :( I think I can fix it tomorrow or tonight. Or if anyone else wants to do that, here's how to fix :-) 305146 3 73035 rolandsteiner 2010-11-04 22:24:57 -0700 Created attachment 73035 What Nikolas wrote 305162 4 73035 krit 2010-11-04 23:31:40 -0700 Comment on attachment 73035 What Nikolas wrote LGTM. r=me 305187 5 73035 zimmermann 2010-11-05 02:08:54 -0700 Comment on attachment 73035 What Nikolas wrote Setting cq+ to get this in ASAP, as my SVGPointList patch also hits the assertion w/o the patch and it's soon ready to be reviewed. 305195 6 commit-queue 2010-11-05 02:41:40 -0700 The commit-queue encountered the following flaky tests while processing attachment 73035: http/tests/appcache/deferred-events-delete-while-raising.html Please file bugs against the tests. These tests were authored by michaeln@google.com. The commit-queue is continuing to process your patch. 305196 7 73035 commit-queue 2010-11-05 02:42:57 -0700 Comment on attachment 73035 What Nikolas wrote Clearing flags on attachment: 73035 Committed r71399: <http://trac.webkit.org/changeset/71399> 305197 8 commit-queue 2010-11-05 02:43:03 -0700 All reviewed patches have been landed. Closing bug. 73035 2010-11-04 22:24:57 -0700 2010-11-05 02:42:57 -0700 What Nikolas wrote bug-48979-20101105142455.patch text/plain 3032 rolandsteiner ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv ZwppbmRleCBkOWVhMTFkZmI5ZTY5ZTk1Y2QyYjczMzUzNDljNDg4ZmJhYzQ2YTEyLi4xOTNkZDJi NzU2MDdlYjBiMTUxOTdjYzBhNDZkNzcwMjY1YWRlYzQwIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0 cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTQgQEAK KzIwMTAtMTEtMDQgIFJvbGFuZCBTdGVpbmVyICA8cm9sYW5kc3RlaW5lckBjaHJvbWl1bS5vcmc+ CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQnVnIDQ4 OTc5IC0gW0Nocm9taXVtXSBTVkdMaXN0UHJvcGVydHlUZWFyT2ZmLmg6IGZ1bmN0aW9uIGNvbW1p dENoYW5nZSBBU1NFUlRzIG9uIFdpbiAmIE1hYworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0 Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NDg5NzkKKworICAgICAgICBSZW1vdmUgQ2hyb21pdW0gZXhw ZWN0YXRpb24gZW50cnkuCisKKyAgICAgICAgKiBwbGF0Zm9ybS9jaHJvbWl1bS90ZXN0X2V4cGVj dGF0aW9ucy50eHQ6CisKIDIwMTAtMTEtMDQgIERhbiBCZXJuc3RlaW4gIDxtaXR6QGFwcGxlLmNv bT4KIAogICAgICAgICBVcGRhdGVkIHRlc3QgcmVzdWx0IGZyb20gcHJldmlvdXMgY29tbWl0LCBh cyBJIHJlbW92ZWQgdGFicyBmcm9tIHRoZSB0ZXN0IGJlZm9yZSBjb21taXR0aW5nCmRpZmYgLS1n aXQgYS9MYXlvdXRUZXN0cy9wbGF0Zm9ybS9jaHJvbWl1bS90ZXN0X2V4cGVjdGF0aW9ucy50eHQg Yi9MYXlvdXRUZXN0cy9wbGF0Zm9ybS9jaHJvbWl1bS90ZXN0X2V4cGVjdGF0aW9ucy50eHQKaW5k ZXggZmNmY2QzMDM0ODRlZGIzMzdhZWI3MGQxMjBhYzE2Mzk1NGJmYjQzYy4uMTg0YjY4MmVhNTRl YzcyZmQxN2NmMTdlM2M2NDUxZTExMjIzMDcxMCAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvcGxh dGZvcm0vY2hyb21pdW0vdGVzdF9leHBlY3RhdGlvbnMudHh0CisrKyBiL0xheW91dFRlc3RzL3Bs YXRmb3JtL2Nocm9taXVtL3Rlc3RfZXhwZWN0YXRpb25zLnR4dApAQCAtMzM5MCw4ICszMzkwLDUg QEAgQlVHNjE4MjQgOiBjYW52YXMvcGhpbGlwL3Rlc3RzLzJkLnBhdHRlcm4uaW1hZ2Uuc3RyaW5n Lmh0bWwgPSBURVhUCiAvLyBUZXN0IGFkZGVkIGluIFdLIHI3MTI4OCBjcmFzaGVzIG9uIFdpbmRv d3MgYW5kIExpbnV4CiBCVUc0ODk3MyBXSU4gTElOVVggOiBlZGl0aW5nL3N0eWxlL2lmcmFtZS1v bmxvYWQtY3Jhc2guaHRtbCA9IENSQVNICiAKLS8vIHN0YXJ0ZWQgdG8gQVNTRVJUIHNvbWV3aGVy ZSBiZXR3ZWVuIFdlYktpdCByNzEyMjQgYW5kIHI3MTMwNQotQlVHNDg5NzkgV0lOIE1BQyBERUJV RyA6IHN2Zy9kb20vYmFzZVZhbC1hbmltVmFsLWNyYXNoLmh0bWwgPSBDUkFTSAotCiAvLyBBZGRl ZCBpbiByNzEzMTcKIEJVRzYxOTc4IFdJTiBNQUMgOiBzdmcvYW5pbWF0aW9ucy9hbmltYXRlLXBh dGgtbmVzdGVkLXRyYW5zZm9ybXMuaHRtbCA9IENSQVNIIFBBU1MKZGlmZiAtLWdpdCBhL1dlYkNv cmUvQ2hhbmdlTG9nIGIvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYmYxNjljZTQyZTdiMGYyNWY0 NTk5NzAyNjQ3OWU4MTBmNDU5NDc5Zi4uNjhkODE3OGIwOWNiMmYyMzExZDQxMTA2ZDM2ZjRkY2Fk N2I0NWVkOSAxMDA2NDQKLS0tIGEvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvV2ViQ29yZS9DaGFu Z2VMb2cKQEAgLTEsMyArMSwxOCBAQAorMjAxMC0xMS0wNCAgUm9sYW5kIFN0ZWluZXIgIDxyb2xh bmRzdGVpbmVyQGNocm9taXVtLm9yZz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P UFMhKS4KKworICAgICAgICBCdWcgNDg5NzkgLSBbQ2hyb21pdW1dIFNWR0xpc3RQcm9wZXJ0eVRl YXJPZmYuaDogZnVuY3Rpb24gY29tbWl0Q2hhbmdlIEFTU0VSVHMgb24gV2luICYgTWFjCisgICAg ICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD00ODk3OQorCisgICAg ICAgIEZ1bmN0aW9uIHJlbW92ZUl0ZW1WYWx1ZXNBbmRXcmFwcGVycygpOiBNb3ZlIGNvZGUgb3V0 IG9mICdpZicgc3RhdGVtZW50IHNvIHRoYXQKKyAgICAgICAgJ3dyYXBwZXJzJyBhbmQgJ3ZhbHVl cycgc3RheSBzeW5jZWQuCisKKyAgICAgICAgdGVzdDogc3ZnL2RvbS9iYXNlVmFsLWFuaW1WYWwt Y3Jhc2guaHRtbCBkb2Vzbid0IEFTU0VSVAorCisgICAgICAgICogc3ZnL3Byb3BlcnRpZXMvU1ZH TGlzdFByb3BlcnR5Lmg6CisgICAgICAgIChXZWJDb3JlOjpTVkdMaXN0UHJvcGVydHk6OnJlbW92 ZUl0ZW1WYWx1ZXNBbmRXcmFwcGVycyk6CisKIDIwMTAtMTEtMDQgIEppYSBQdSAgPGpwdUBhcHBs ZS5jb20+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgRGFuIEJlcm5zdGVpbi4KZGlmZiAtLWdpdCBh L1dlYkNvcmUvc3ZnL3Byb3BlcnRpZXMvU1ZHTGlzdFByb3BlcnR5LmggYi9XZWJDb3JlL3N2Zy9w cm9wZXJ0aWVzL1NWR0xpc3RQcm9wZXJ0eS5oCmluZGV4IDhjZGJmZDA4MDViNjIzMDFhMzY3MWE5 OWFjZTRiNjdhODExZGJlYzguLjdlZGMwZjE5OGUxZWVjZWM5Y2I1ZTI1Y2U4OTY0YWUxMGIzNDQz YjAgMTAwNjQ0Ci0tLSBhL1dlYkNvcmUvc3ZnL3Byb3BlcnRpZXMvU1ZHTGlzdFByb3BlcnR5LmgK KysrIGIvV2ViQ29yZS9zdmcvcHJvcGVydGllcy9TVkdMaXN0UHJvcGVydHkuaApAQCAtMzM3LDEx ICszMzcsMTAgQEAgcHVibGljOgogCiAgICAgICAgIC8vIERldGFjaCB0aGUgZXhpc3Rpbmcgd3Jh cHBlci4KICAgICAgICAgUmVmUHRyPExpc3RJdGVtVGVhck9mZj4mIG9sZEl0ZW0gPSB3cmFwcGVy cy5hdChpbmRleCk7Ci0gICAgICAgIGlmIChvbGRJdGVtKSB7CisgICAgICAgIGlmIChvbGRJdGVt KQogICAgICAgICAgICAgb2xkSXRlbS0+ZGV0YWNoV3JhcHBlcigpOwotICAgICAgICAgICAgd3Jh cHBlcnMucmVtb3ZlKGluZGV4KTsKLSAgICAgICAgfQogCisgICAgICAgIHdyYXBwZXJzLnJlbW92 ZShpbmRleCk7CiAgICAgICAgIHZhbHVlcy5yZW1vdmUoaW5kZXgpOwogCiAgICAgICAgIGNvbW1p dENoYW5nZSgpOwo=