If SVGAnimatedListPropertyTearOff is not animating this means its m_animatedProperty is null. In this case SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded() should do nothing. Otherwise a crash will happen.
SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded() can now be called from SVGAnimatedTypeAnimator::resetFromBaseValue() and a very intermittent crash with the following call stack was recorded:
The crash was happening because SVGAnimatedListPropertyTearOff::m_animatedProperty is null.
Created attachment 330518 [details]
Created attachment 330556 [details]
Comment on attachment 330556 [details]
View in context: https://bugs.webkit.org/attachment.cgi?id=330556&action=review
> + This is a speculative change to fix a crash which appeared after r226065.
This should say why there is no testcase.
> + if (!isAnimating())
We normally avoid patterns like this. If you think the assert and the if() are both needed, then add a comment saying "this should never happen, but we've seen it in the field. Please comment in bug ### i you hit this" or something.
Created attachment 330559 [details]
Comment on attachment 330559 [details]
Clearing flags on attachment: 330559
Committed r226457: <https://trac.webkit.org/changeset/226457>
All reviewed patches have been landed. Closing bug.