Bug 21682

Summary: REGRESSION: r37631 causing crashes on buildbot
Product: WebKit Reporter: Sam Weinig <sam>
Component: JavaScriptCoreAssignee: Maciej Stachowiak <mjs>
Status: RESOLVED FIXED    
Severity: Normal CC: ap
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Mac   
OS: OS X 10.5   
Attachments:
Description Flags
crashlog
none
crash fix oliver: review+

Sam Weinig
Reported 2008-10-16 15:35:16 PDT
r37631 is causing svg/W3C-SVG-1.1/animate-elem-39-t.svg and svg/W3C-SVG-1.1/animate-elem-40-t.svg to crash in JSC::Heap::collect() (collector.cpp:974)
Attachments
crashlog (56.21 KB, text/plain)
2008-10-16 15:35 PDT, Sam Weinig 		no flags
Details
crash fix (1.29 KB, patch)
2008-10-16 19:50 PDT, Maciej Stachowiak 		oliver: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Sam Weinig
Comment 1 2008-10-16 15:35:55 PDT
Created attachment 24433 [details] crashlog
Maciej Stachowiak
Comment 2 2008-10-16 19:50:33 PDT
Created attachment 24451 [details] crash fix
Oliver Hunt
Comment 3 2008-10-16 19:58:32 PDT
Comment on attachment 24451 [details] crash fix r=me
Note You need to log in before you can comment on or make changes to this bug.