Bug 21682 - REGRESSION: r37631 causing crashes on buildbot
Summary: REGRESSION: r37631 causing crashes on buildbot
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Macintosh OS X 10.5
: P2 Normal
Assignee: Maciej Stachowiak
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-10-16 15:35 PDT by Sam Weinig
Modified: 2008-10-17 00:30 PDT (History)
1 user (show)

See Also:


Attachments
crashlog (56.21 KB, text/plain)
2008-10-16 15:35 PDT, Sam Weinig
no flags Details
crash fix (1.29 KB, patch)
2008-10-16 19:50 PDT, Maciej Stachowiak
oliver: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Sam Weinig 2008-10-16 15:35:16 PDT
r37631 is causing svg/W3C-SVG-1.1/animate-elem-39-t.svg and svg/W3C-SVG-1.1/animate-elem-40-t.svg to crash in JSC::Heap::collect() (collector.cpp:974)
Comment 1 Sam Weinig 2008-10-16 15:35:55 PDT
Created attachment 24433 [details]
crashlog
Comment 2 Maciej Stachowiak 2008-10-16 19:50:33 PDT
Created attachment 24451 [details]
crash fix
Comment 3 Oliver Hunt 2008-10-16 19:58:32 PDT
Comment on attachment 24451 [details]
crash fix

r=me