Bug 233819

Summary: CSS animation sorting may crash due to AnimationList copy upon CSS Animation removal
Product: WebKit Reporter: Antoine Quint <graouts>
Component: AnimationsAssignee: Antoine Quint <graouts>
Status: RESOLVED FIXED    
Severity: Normal CC: darin, dino, gnavamarino, graouts, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch for landing none

Description Antoine Quint 2021-12-03 09:24:04 PST
CSS animation sorting may crash due to AnimationList copy upon CSS Animation removal
Comment 1 Antoine Quint 2021-12-03 09:42:56 PST
Created attachment 445868 [details]
Patch
Comment 2 Antoine Quint 2021-12-03 09:43:02 PST
<rdar://problem/85596065>
Comment 3 Dean Jackson 2021-12-03 09:49:03 PST
Comment on attachment 445868 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=445868&action=review

> Source/WebCore/ChangeLog:52
> +

When the ChangeLog is much bigger than the change.

> Source/WebCore/platform/animation/AnimationList.h:39
> +    Ref<AnimationList> copy(CopyAnimations copyAnimations = CopyAnimations::Yes) const { return adoptRef(*new AnimationList(*this, copyAnimations)); }

It seems weird that you could have copy(CopyAnimations::No) - until you realise you're talking about the members of the list. So maybe it should be called CopyAnimationMembers? Or flip it and call it Clone? I don't know. It's just a bit confusing.
Comment 4 Antoine Quint 2021-12-03 10:25:09 PST
(In reply to Dean Jackson from comment #3)
> Comment on attachment 445868 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=445868&action=review
> 
> > Source/WebCore/platform/animation/AnimationList.h:39
> > +    Ref<AnimationList> copy(CopyAnimations copyAnimations = CopyAnimations::Yes) const { return adoptRef(*new AnimationList(*this, copyAnimations)); }
> 
> It seems weird that you could have copy(CopyAnimations::No) - until you
> realise you're talking about the members of the list. So maybe it should be
> called CopyAnimationMembers? Or flip it and call it Clone? I don't know.
> It's just a bit confusing.

I'll go with enum class `CopyBehavior { Clone, Reference }`.
Comment 5 Darin Adler 2021-12-03 10:31:28 PST
Comment on attachment 445868 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=445868&action=review

>>> Source/WebCore/platform/animation/AnimationList.h:39
>>> +    Ref<AnimationList> copy(CopyAnimations copyAnimations = CopyAnimations::Yes) const { return adoptRef(*new AnimationList(*this, copyAnimations)); }
>> 
>> It seems weird that you could have copy(CopyAnimations::No) - until you realise you're talking about the members of the list. So maybe it should be called CopyAnimationMembers? Or flip it and call it Clone? I don't know. It's just a bit confusing.
> 
> I'll go with enum class `CopyBehavior { Clone, Reference }`.

I think it might be better to just have two separate named functions, maybe copy and shallowCopy? We can still use just a single constructor with an argument, but that would be private.
Comment 6 Antoine Quint 2021-12-03 11:17:56 PST
(In reply to Darin Adler from comment #5)
> Comment on attachment 445868 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=445868&action=review
> 
> >>> Source/WebCore/platform/animation/AnimationList.h:39
> >>> +    Ref<AnimationList> copy(CopyAnimations copyAnimations = CopyAnimations::Yes) const { return adoptRef(*new AnimationList(*this, copyAnimations)); }
> >> 
> >> It seems weird that you could have copy(CopyAnimations::No) - until you realise you're talking about the members of the list. So maybe it should be called CopyAnimationMembers? Or flip it and call it Clone? I don't know. It's just a bit confusing.
> > 
> > I'll go with enum class `CopyBehavior { Clone, Reference }`.
> 
> I think it might be better to just have two separate named functions, maybe
> copy and shallowCopy? We can still use just a single constructor with an
> argument, but that would be private.

Event better.
Comment 7 Antoine Quint 2021-12-04 06:46:20 PST
Created attachment 445969 [details]
Patch for landing
Comment 8 EWS 2021-12-04 07:28:55 PST
Committed r286532 (244864@main): <https://commits.webkit.org/244864@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 445969 [details].
Comment 9 Antoine Quint 2021-12-07 00:16:29 PST
*** Bug 233672 has been marked as a duplicate of this bug. ***