| Summary: | REGRESSION (Safari 5.0.5 - ToT): crash in SVG test http://dev.w3.org/SVG/profiles/1.1F2/test/harness/htmlObjectApproved/animate-elem-39-t.html | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | lars.sonchocky-helldorf | ||||||||
| Component: | SVG | Assignee: | Stephen Chenney <schenney> | ||||||||
| Status: | RESOLVED FIXED | ||||||||||
| Severity: | Normal | CC: | enne, jknotten, krit, pkasting, schenney, scottmg, thorton, webkit.review.bot, zimmermann | ||||||||
| Priority: | P1 | Keywords: | Regression | ||||||||
| Version: | 528+ (Nightly build) | ||||||||||
| Hardware: | Unspecified | ||||||||||
| OS: | Unspecified | ||||||||||
| URL: | http://dev.w3.org/SVG/profiles/1.1F2/test/harness/htmlObjectApproved/animate-elem-39-t.html | ||||||||||
| Attachments: |
|
||||||||||
|
Description
lars.sonchocky-helldorf
2011-07-17 13:25:09 PDT
Created attachment 101118 [details]
64671_crash_log
crash log for this bug
The PaintServer crashes because of a missing RenderStyle on SVGFonts. I couldn't reproduce it locally when SVGFonts are not online. I cannot reproduce with Safari 5.0.5, so marking as regression. (In reply to comment #3) > I cannot reproduce with Safari 5.0.5, so marking as regression. It's an assertion, no crash. Have you checked debug version of WebKit? IIRC we have this bug for a longer time and I think we even had it on Safari 5. *** Bug 53858 has been marked as a duplicate of this bug. *** Created attachment 102148 [details]
minimized from original url, causing crash in SVGSMILElement::progress
I'm seeing an assert in SVGSMILElement::progress (not the same as the crash?). It appears to be caused by update order as there's multiple begins that are "showAnchor.end+1s" including showAnchor's. *** Bug 64940 has been marked as a duplicate of this bug. *** *** Bug 66888 has been marked as a duplicate of this bug. *** *** Bug 73710 has been marked as a duplicate of this bug. *** *** Bug 74788 has been marked as a duplicate of this bug. *** To clarrify what this bug is about, on a seemingly random basis many of the tests of the form svg/W3C-SVG-1.1/animate-elem-??-?.svg and also svg/animations/svginteger-animation-1.html all fail with one of two assertions in SVGSMILElement::progress for Mac and Linux. Created attachment 123409 [details]
Patch
I think this change addresses the crash, and also ensures that the callback method for "no longer active" fires. It is also safe to just remove the offending assert, but then the callback would not fire. Comment on attachment 123409 [details]
Patch
Looks good, r=me. Thanks for investigating!
Comment on attachment 123409 [details] Patch Clearing flags on attachment: 123409 Committed r105572: <http://trac.webkit.org/changeset/105572> All reviewed patches have been landed. Closing bug. |