12434 2007-01-27 03:21:50 -0800 Removing SVG animation element during animation crashes WebKit 2011-05-06 09:42:57 -0700 1 1 1 Unclassified WebKit SVG 420+ Mac OS X 10.4 RESOLVED FIXED http://www.w3.org/Graphics/SVG/Test/20061213/htmlEmbedHarness/full-animate-elem-40-t.html InRadar P1 Normal --- 41761 1 eric webkit-unassigned bdakin jeffschiller krit rwlbuis simon.fraser oldest_to_newest 32124 0 eric 2007-01-27 03:21:50 -0800 This is similar to the bug: http://bugs.webkit.org/show_bug.cgi?id=12065 which covers removing the animation *target* during animation. This bug refers to removing the actual animation element. See the attached test case. 32125 1 12703 eric 2007-01-27 03:26:13 -0800 Created attachment 12703 test case (crashes safari) 32126 2 eric 2007-01-27 03:32:08 -0800 Part of the problem is that animation notification lists are held off of the time scheduler, which is held off of the containing <svg> element. this is done because (according to the spec) each <svg> document fragment can have an independent animation timeline. (Which sorta makes sense, given the desire to build an animation editor within SVG.) So if you remove an animation element (even if it's kept alive) it will have trouble finding its <svg> element to remove itself from the notify list. The best fix is to re-work the animation notify system, as discussed in: http://bugs.webkit.org/show_bug.cgi?id=12432 But short of that, an easier fix, is to implement willRemove() and insertedIntoDocument() and add/remove the animation from the notify list on the parent <svg>. In order to support independent timelines for <svg> document fragments (as mentioned in http://bugs.webkit.org/show_bug.cgi?id=12073), we'll need to actually be careful to update the animation element if moving between <svg> document fragments (that may also affect the target of the animation, among other things, and certainly would stop the animation when removing it from one fragment before inserting it into the other). 32108 3 eric 2007-01-27 03:51:59 -0800 I believe this bug is the cause of the crash here: http://www.w3.org/Graphics/SVG/Test/20061213/htmlEmbedHarness/full-animate-elem-40-t.html 31137 4 mjs 2007-01-29 03:53:02 -0800 <rdar://problem/4960664> 25387 5 mjs 2007-02-07 01:09:03 -0800 <rdar://problem/4960506> 21344 6 mjs 2007-02-26 11:46:03 -0800 No longer a P1, since animation is disabled for now. 58779 7 eric 2007-10-18 00:31:17 -0700 Animation has been re-enabled on trunk (as part of SVG_EXPERIMENTAL_FEATURES) thus this should be bumped back to P1 according to the bug guidelines (and mjs). 65360 8 eric 2007-12-27 01:42:56 -0800 Animation is turned off again in trunk (a good thing). This can be pushed down to a P3. 75379 9 eric 2008-03-26 17:09:56 -0700 Animation is back on. This goes back to p1. 109615 10 simon.fraser 2009-02-12 21:35:26 -0800 Related to bug 12065? 399485 11 rwlbuis 2011-05-06 07:05:16 -0700 I can't reproduce this using a recent checkout. Cheers, Rob. 399568 12 krit 2011-05-06 09:42:57 -0700 This was fixed several month ago. Forgot to close the bug. 12703 2007-01-27 03:26:13 -0800 2007-01-27 03:26:13 -0800 test case (crashes safari) test.svg image/svg+xml 511 eric PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPgogICAgPHJlY3QgaWQ9InJl Y3QiIGZpbGw9ImdyZWVuIiB3aWR0aD0nNTAnIGhlaWdodD0nNTAnPgogICAgICA8YW5pbWF0ZVRy YW5zZm9ybSBpZD0nYW5pbWF0aW9uJyBhdHRyaWJ1dGVOYW1lPSJ0cmFuc2Zvcm0iIHR5cGU9InNj YWxlIiBmcm9tPSIxIiB0bz0iMiIgZHVyPSIxcyIgZmlsbD0iZnJlZXplIi8+CiAgICA8L3JlY3Q+ CgogICAgPHNjcmlwdD4KICAgICAgICA8IVtDREFUQVsKICAgICAgICB2YXIgdGVzdEZ1bmN0aW9u ID0gZnVuY3Rpb24oKSB7CiAgICAgICAgICAgIHZhciBhbmltYXRpb24gPSBkb2N1bWVudC5nZXRF bGVtZW50QnlJZCgiYW5pbWF0aW9uIikKICAgICAgICAgICAgYW5pbWF0aW9uLnBhcmVudE5vZGUu cmVtb3ZlQ2hpbGQoYW5pbWF0aW9uKTsKICAgICAgICB9CiAgICAgICAgd2luZG93LnNldFRpbWVv dXQodGVzdEZ1bmN0aW9uLCAxMCk7CiAgICAgICAgXV0+CiAgICA8L3NjcmlwdD4KPC9zdmc+Cg==