[Webkit-unassigned] [Bug 48979] New: [Chromium] SVGListPropertyTearOff.h: function commitChange ASSERTs on Win & Mac

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=48979

           Summary: [Chromium] SVGListPropertyTearOff.h: function
                    commitChange ASSERTs on Win & Mac
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Mac OS X 10.5
            Status: NEW
          Keywords: LayoutTestFailure
          Severity: Normal
          Priority: P2
         Component: SVG
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: rolandsteiner at chromium.org
                CC: zimmermann at kde.org, mdelaney at apple.com


The function commitChange() in SVGListPropertyTearOff.h started to run into " ASSERT(size == values.size()); " on Chromium Windows and Mac (at least), sometimes between WK r71224 and r71305.

The failed condition seems to have no adverse effect in Release (where the ASSERT isn't run), but it still seems fishy:

'values' has 1 entry, while 'wrappers' has 2, with the first entry being NULL.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.