Bug 12434 – Removing SVG animation element during animation crashes WebKit

• Component: SVG
• Status: RESOLVED FIXED

[Eric Seidel (no email)]

This is similar to the bug:
http://bugs.webkit.org/show_bug.cgi?id=12065
which covers removing the animation *target* during animation.

This bug refers to removing the actual animation element.

See the attached test case.

[Eric Seidel (no email)]

Created attachment 12703 [details]
test case (crashes safari)

[Eric Seidel (no email)]

Part of the problem is that animation notification lists are held off of the time scheduler, which is held off of the containing <svg> element.  this is done because (according to the spec) each <svg> document fragment can have an independent animation timeline.  (Which sorta makes sense, given the desire to build an animation editor within SVG.)  So if you remove an animation element (even if it's kept alive) it will have trouble finding its <svg> element to remove itself from the notify list.

The best fix is to re-work the animation notify system, as discussed in:
http://bugs.webkit.org/show_bug.cgi?id=12432

But short of that, an easier fix, is to implement willRemove() and insertedIntoDocument() and add/remove the animation from the notify list on the parent <svg>.

In order to support independent timelines for <svg> document fragments (as mentioned in http://bugs.webkit.org/show_bug.cgi?id=12073), we'll need to actually be careful to update the animation element if moving between <svg> document fragments (that may also affect the target of the animation, among other things, and certainly would stop the animation when removing it from one fragment before inserting it into the other).

[Eric Seidel (no email)]

I believe this bug is the cause of the crash here:
http://www.w3.org/Graphics/SVG/Test/20061213/htmlEmbedHarness/full-animate-elem-40-t.html

[Maciej Stachowiak]

<rdar://problem/4960664>

[Maciej Stachowiak]

<rdar://problem/4960506>

[Maciej Stachowiak]

No longer a P1, since animation is disabled for now.

[Eric Seidel (no email)]

Animation has been re-enabled on trunk (as part of SVG_EXPERIMENTAL_FEATURES) thus this should be bumped back to P1 according to the bug guidelines (and mjs).

[Eric Seidel (no email)]

Animation is turned off again in trunk (a good thing).  This can be pushed down to a P3.

[Eric Seidel (no email)]

Animation is back on.  This goes back to p1.

[Simon Fraser (smfr)]

Related to bug 12065?

[Rob Buis]

I can't reproduce this using a recent checkout.
Cheers,

Rob.

[Dirk Schulze]

This was fixed several month ago. Forgot to close the bug.