If SVGAnimatedListPropertyTearOff is not animating this means its m_animatedProperty is null. In this case SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded() should do nothing. Otherwise a crash will happen. SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded() can now be called from SVGAnimatedTypeAnimator::resetFromBaseValue() and a very intermittent crash with the following call stack was recorded: WebCore::SVGListProperty<WebCore::SVGTransformListValues>::values() WebCore::SVGAnimatedListPropertyTearOff<WebCore::SVGTransformListValues>::synchronizeWrappersIfNeeded() WebCore::SVGAnimatedTypeAnimator::resetFromBaseValue<WebCore::SVGAnimatedTransformListPropertyTearOff>() WebCore::SVGAnimatedTransformListAnimator::resetAnimValToBaseVal() WebCore::SVGAnimateElementBase::resetAnimatedType() The crash was happening because SVGAnimatedListPropertyTearOff::m_animatedProperty is null.
<rdar://problem/36147545>
Created attachment 330518 [details] Patch
Created attachment 330556 [details] Patch
Comment on attachment 330556 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=330556&action=review > Source/WebCore/ChangeLog:9 > + This is a speculative change to fix a crash which appeared after r226065. This should say why there is no testcase. > Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h:147 > ASSERT(isAnimating()); > + if (!isAnimating()) We normally avoid patterns like this. If you think the assert and the if() are both needed, then add a comment saying "this should never happen, but we've seen it in the field. Please comment in bug ### i you hit this" or something.
Created attachment 330559 [details] Patch
Comment on attachment 330559 [details] Patch Clearing flags on attachment: 330559 Committed r226457: <https://trac.webkit.org/changeset/226457>
All reviewed patches have been landed. Closing bug.