Bug 33495

*** Bug 34732 has been marked as a duplicate of this bug. ***

See a duplicated bug about svg/dynamic-updates/SVGLineElement-svgdom-y2-prop.html. The bots also just saw: svg/dynamic-updates/SVGRadialGradientElement-svgdom-fy-prop.html crash: http://build.webkit.org/results/Windows%20Release%20(Tests)/r55161%20(9366)/results.html

Someone with a windows box should ideally try: run-webkit-tests svg/dynamic-updates --iterations=1000 and see if it crashes (so we can get a back-trace).

*** Bug 37339 has been marked as a duplicate of this bug. ***

A few other tests have been crashing recently: svg/dynamic-updates/SVGMaskElement-svgdom-x-prop.html <http://build.webkit.org/results/Windows%20Release%20(Tests)/r57792%20(11412)/results.html> svg/dynamic-updates/SVGLineElement-svgdom-x2-prop.html <http://build.webkit.org/results/Windows%20Release%20(Tests)/r57791%20(11411)/results.html> svg/dynamic-updates/SVGMarkerElement-svgdom-refX-prop.html <http://build.webkit.org/results/Windows%20Release%20(Tests)/r57790%20(11410)/results.html> svg/dynamic-updates/SVGLinearGradientElement-svgdom-x1-prop.html svg/dynamic-updates/SVGRectElement-svgdom-width-prop.html <http://build.webkit.org/results/Windows%20Release%20(Tests)/r57788%20(11408)/results.html>

<rdar://problem/7877403>

svg/dynamic-updates/SVGRadialGradientElement-svgdom-fx-prop.html: <http://build.webkit.org/results/Windows%20Release%20(Tests)/r57810%20(11431)/results.html>

I tried running the dynamic-updates tests on Debug and couldn't get a crash. Then I ran them on Release and got a crash pretty quickly. Here's the backtrace: 075f3bbf() > WebKit.dll!WebCore::jsSVGLengthValueAsString(JSC::ExecState * exec=, JSC::JSValue slotBase={...}, const JSC::Identifier & __formal=) Line 218 + 0x14 bytes C++ WebKit.dll!WebCore::JSSVGLength::getOwnPropertySlot(JSC::ExecState * exec=0x0012e9c0, const JSC::Identifier & propertyName={...}, JSC::PropertySlot & slot={...}) Line 182 + 0x15 bytes C++ JavaScriptCore.dll!JSC::JSValue::get(JSC::ExecState * exec=0x037b0188, const JSC::Identifier & propertyName={...}, JSC::PropertySlot & slot={...}) Line 633 + 0x34 bytes C++ JavaScriptCore.dll!cti_op_get_by_id(void * * args=0x00000000) Line 1465 C++ JavaScriptCore.dll!JSC::Interpreter::execute(JSC::EvalExecutable * eval=0x7f0b3690, JSC::ExecState * callFrame=0x037b0110, JSC::JSObject * thisObj=0x03bc0000, int globalRegisterOffset=49, JSC::ScopeChainNode * scopeChain=0x7ff20930, JSC::JSValue * exception=0x0012ebe8) Line 854 C++ JavaScriptCore.dll!JSC::Interpreter::callEval(JSC::ExecState * callFrame=0x00000000, JSC::RegisterFile * registerFile=0x7fef32dc, JSC::Register * argv=0x037b0138, int argc=58392576, int registerOffset=15, JSC::JSValue & exceptionValue={...}) Line 316 + 0x63 bytes C++ JavaScriptCore.dll!cti_op_call_eval(void * * args=0x00000000) Line 2903 C++ JavaScriptCore.dll!JSC::Interpreter::execute(JSC::ProgramExecutable * program=0x7f0b30e0, JSC::ExecState * callFrame=0x7fcb4068, JSC::ScopeChainNode * scopeChain=0x7fa1de10, JSC::JSObject * thisObj=0x03bc0000, JSC::JSValue * exception=0x0012ecd8) Line 626 C++ JavaScriptCore.dll!JSC::evaluate(JSC::ExecState * exec=, JSC::ScopeChain & scopeChain=, const JSC::SourceCode & source=, JSC::JSValue thisValue={...}) Line 65 C++ WebKit.dll!WebCore::ScriptController::windowShell(WebCore::DOMWrapperWorld * world=0x0000003f) Line 85 + 0x14 bytes C++ 00000040()

The backtrace in comment 8 occurred when running both SVGLinearGradientElement-svgdom-y1-prop.html and SVGLinearGradientElement-svgdom-x1-prop.html.

Got a slightly different backtrace when I ran under the debugger (rather than attaching the debugger at the time of the crash). This was for SVGEllipseElement-svgdom-rx-prop.html: JavaScriptCore.dll!JSC::UStringImpl::createUninitialized(unsigned int length=2142638116, wchar_t * & data=) + 0x395de bytes C++ WebKit.dll!WebCore::CachedScriptSourceProvider::getRange(int start=1239560, int end=1239488) Line 46 + 0x2c bytes C++ > WebKit.dll!WebCore::JSSVGLength::value(JSC::ExecState * exec=0x1003e2f8) Line 34 + 0xe bytes C++ JavaScriptCore.dll!JSC::JSValue::get(JSC::ExecState * exec=0x037b0120, const JSC::Identifier & propertyName={...}, JSC::PropertySlot & slot={...}) Line 633 + 0x34 bytes C++ JavaScriptCore.dll!cti_op_get_by_id(void * * args=0x00000000) Line 1465 C++ JavaScriptCore.dll!JSC::Interpreter::execute(JSC::EvalExecutable * eval=0x7f068af0, JSC::ExecState * callFrame=0x037b00a8, JSC::JSObject * thisObj=0x03bc0000, int globalRegisterOffset=36, JSC::ScopeChainNode * scopeChain=0x7fd80378, JSC::JSValue * exception=0x0012ebe8) Line 854 C++ JavaScriptCore.dll!JSC::Interpreter::callEval(JSC::ExecState * callFrame=0x00000000, JSC::RegisterFile * registerFile=0x7fef32dc, JSC::Register * argv=0x037b00d0, int argc=58392576, int registerOffset=15, JSC::JSValue & exceptionValue={...}) Line 316 + 0x63 bytes C++ JavaScriptCore.dll!cti_op_call_eval(void * * args=0x00000000) Line 2903 C++ JavaScriptCore.dll!JSC::Interpreter::execute(JSC::ProgramExecutable * program=0x7f077fc0, JSC::ExecState * callFrame=0x7fede968, JSC::ScopeChainNode * scopeChain=0x7fc77d68, JSC::JSObject * thisObj=0x03bc0000, JSC::JSValue * exception=0x0012ecd8) Line 626 C++ JavaScriptCore.dll!JSC::evaluate(JSC::ExecState * exec=, JSC::ScopeChain & scopeChain=, const JSC::SourceCode & source=, JSC::JSValue thisValue={...}) Line 65 C++ WebKit.dll!WebCore::ScriptController::windowShell(WebCore::DOMWrapperWorld * world=0x0000003f) Line 85 + 0x14 bytes C++ 00000040()

Turning on full page heap doesn't change the backtrace.

Changed component to SVG, so it shows up in my all-svg-bugs search.

We haven't seen this on the bots in a while, and we are running these tests. I guess it's gone!