Bug 18137

Summary: Crash on acid3 test 54
Product: WebKit Reporter: kappasolaris <webkit.20.kappa>
Component: DOMAssignee: Nobody <webkit-unassigned>
Status: UNCONFIRMED ---    
Severity: Normal CC: mrowe
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: Other   
Description Flags
Crash dump none

Description kappasolaris 2008-03-27 02:24:40 PDT
I'm getting a crash on acid3 test 54, and apparently changeset 31273 is at fault here, specifically this change in dom/Element.cpp: 
-    String localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;                                                                       
+    const String& localName = (shouldIgnoreAttributeCase(this) && !name.impl()->isLower()) ? name.lower() : name; 

Note the addition of "&", if I remove it, it's all good again...
Comment 1 kappasolaris 2008-03-27 02:26:24 PDT
Created attachment 20120 [details]
Crash dump
Comment 2 kappasolaris 2008-03-27 02:42:22 PDT
To clarify, I don't know if it's specifically test 54, I just go to http://acid3.acidtests.org/ and it crashes while showing 54/100.
Comment 3 kappasolaris 2008-03-27 02:49:52 PDT
That's on OpenSolaris with Sun Studio 12 compiler.
Comment 4 Mark Rowe (bdash) 2008-03-27 23:55:07 PDT
The fact that removing the & fixes the crash for you suggests that this may be a compiler optimisation bug.