[Webkit-unassigned] [Bug 109514] New: [Microdata] Fix crash after r141034 in chromuim port

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=109514

           Summary: [Microdata] Fix crash after r141034 in chromuim port
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML DOM
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: arko at motorola.com


Below test cases are crashing in chromium port after revision r141034

  fast/dom/MicroData/domsettabletokenlist-attributes-add-token.html [ Crash ]
  fast/dom/MicroData/domsettabletokenlist-attributes-out-of-range-index.html [ Crash ]
  fast/dom/MicroData/element-with-empty-itemprop.html [ Crash ]
  fast/dom/MicroData/itemprop-add-remove-tokens.html [ Crash ]
  fast/dom/MicroData/itemprop-for-an-element-must-be-correct.html [ Crash ]
  fast/dom/MicroData/itemprop-must-be-read-only.html [ Crash ]
  fast/dom/MicroData/itemprop-reflected-by-itemProp-property.html [ Crash ]
  fast/dom/MicroData/itemref-add-remove-tokens.html [ Crash ]
  fast/dom/MicroData/itemref-attribute-reflected-by-itemRef-property.html [ Crash ]
  fast/dom/MicroData/itemref-for-an-element-must-be-correct.html [ Crash ]
  fast/dom/MicroData/itemref-must-be-read-only.html [ Crash ]
  fast/dom/MicroData/itemtype-add-remove-tokens.html [ Crash ]
  fast/dom/MicroData/itemtype-attribute-test.html [ Crash ]
  fast/dom/MicroData/microdata-domtokenlist-attribute-add-remove-tokens.html [ Crash ]
  fast/dom/MicroData/properties-collection-namedgetter-with-invalid-name.html [ Crash ]
  fast/dom/MicroData/propertynodelist-add-remove-itemprop-tokens.html [ Crash ]
  fast/dom/MicroData/propertynodelist-add-remove-itemref-tokens.html [ Crash ]

Backtrace:

crash log for DumpRenderTree (pid 18653):
STDOUT: <empty>
STDERR: 1   0x202fad2
STDERR: 2   0x2010e28
STDERR: 3   0x2155637
STDERR: 4   0x215ccd0
STDERR: 5   0x213781c
STDERR: 6   0xd40fa3
STDERR: 7   0xd43352
STDERR: 8   0xccc8f1
STDERR: 9   0xcd0840
STDERR: 10  0x2fde2cf06362
STDERR: Received signal 11 SEGV_MAPERR 0000bbadbeef
STDERR:  [0x00000099e62c] base::debug::StackTrace::StackTrace()
STDERR:  [0x00000099df11] base::debug::(anonymous namespace)::StackDumpSignalHandler()
STDERR:  [0x7f0970a2ccb0] <unknown>
STDERR:  [0x00000202fadc] WebCore::checkTypeOrDieTrying()
STDERR:  [0x000002010e28] WebCore::V8DOMSettableTokenList::createWrapper()
STDERR:  [0x000002155637] WebCore::wrap()
STDERR:  [0x00000215ccd0] WebCore::toV8Fast<>()
STDERR:  [0x00000213781c] WebCore::HTMLElementV8Internal::itemRefAttrGetter()
STDERR:  [0x000000d40fa3] v8::internal::JSObject::GetPropertyWithCallback()
STDERR:  [0x000000d43352] v8::internal::Object::GetProperty()
STDERR:  [0x000000ccc8f1] v8::internal::LoadIC::Load()
STDERR:  [0x000000cd0840] v8::internal::LoadIC_Miss()
STDERR:  [0x2fde2cf06362] <unknown>
STDERR:   r8: 00007f096c869980  r9: 00007f097480a0f0 r10: 0000000000000001 r11: 0000000000000000
STDERR:  r12: 00001fb0b172d811 r13: 00007f09746880b8 r14: 0000000000000002 r15: 00007fff07ae5820
STDERR:   di: 0000000000000000  si: 00000000efcdab90  bp: 00007fff07ae5310  bx: 000017d7e285f529
STDERR:   dx: 00007f0970203ac0  ax: 00000000bbadbeef  cx: 00007f096ff2f91d  sp: 00007fff07ae52f0
STDERR:   ip: 000000000202fadc efl: 0000000000010246 cgf: 0000000000000033 erf: 0000000000000006
STDERR:  trp: 000000000000000e msk: 0000000000000000 cr2: 00000000bbadbeef

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.