Bug 21682

Summary: REGRESSION: r37631 causing crashes on buildbot
Product: WebKit Reporter: Sam Weinig <sam>
Component: JavaScriptCoreAssignee: Maciej Stachowiak <mjs>
Status: RESOLVED FIXED    
Severity: Normal CC: ap
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Mac   
OS: OS X 10.5   
Attachments:
Description Flags
crashlog
none
crash fix oliver: review+

Description Sam Weinig 2008-10-16 15:35:16 PDT 
r37631 is causing svg/W3C-SVG-1.1/animate-elem-39-t.svg and svg/W3C-SVG-1.1/animate-elem-40-t.svg to crash in JSC::Heap::collect() (collector.cpp:974)
Comment 1 Sam Weinig 2008-10-16 15:35:55 PDT 
Created attachment 24433 [details]
crashlog
Comment 2 Maciej Stachowiak 2008-10-16 19:50:33 PDT 
Created attachment 24451 [details]
crash fix
Comment 3 Oliver Hunt 2008-10-16 19:58:32 PDT 
Comment on attachment 24451 [details]
crash fix

r=me