Summary: | REGRESSION: Reproducible assertion failure in Shared<WebCore::StringImpl>::ref() running svg/custom/svg/custom/gradient-attr-update.svg | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Geoffrey Garen <ggaren> | ||||
Component: | SVG | Assignee: | Geoffrey Garen <ggaren> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | darin | ||||
Priority: | P1 | Keywords: | LayoutTestFailure | ||||
Version: | 420+ | ||||||
Hardware: | Mac | ||||||
OS: | OS X 10.4 | ||||||
URL: | svg/custom/svg/custom/gradient-attr-update.svg | ||||||
Attachments: |
|
Description
Geoffrey Garen
2006-10-24 12:33:49 PDT
ASSERTION FAILED: !m_inDestructor (/Users/ggaren/Labyrinth/OpenSource/WebCore/platform/Shared.h:41 void WebCore::Shared<T>::ref() [with T = WebCore::StringImpl]) m_inDestructor and m_refCount are garbage, so the assertion is only accidentally correct. *** Bug 11403 has been marked as a duplicate of this bug. *** StyleFillData.paint has been destroyed. Sounds like a case for RefPtr. Looks to me like the root of the problem is that StyleFillData has a SVGPaint* instead of RefPtr<SVGPaint>. I don't get how the classes in SVGRenderStyleDefs.h (e.g. StyleStrokeData) can go without reference counting. Created attachment 11196 [details]
fix
Comment on attachment 11196 [details]
fix
r=me
Committed revision 17272. |