Bug 303220 – [threaded-animations] WPT test `scroll-animations/view-timelines/timeline-offset-in-keyframe.html` crashes with "Threaded Scroll-driven Animations" enabled

• Component: New Bugs
• Status: RESOLVED FIXED

[Antoine Quint]

The following command crashes WebKitTestRunner:

run-webkit-tests --debug --experimental-feature ThreadedScrollDrivenAnimationsEnabled=true imported/w3c/web-platform-tests/scroll-animations/view-timelines/timeline-offset-in-keyframe.html

Here's the relevant chunk of the call stack:

#0	0x10b75fb78 in ::WTFCrash() at /Source/WTF/wtf/Assertions.cpp:377
#1	0x30033fcd8 in WTF::CrashOnOverflow::crash at /Builds/Debug/usr/local/include/wtf/CheckedArithmetic.h:110
#2	0x30033fcc8 in WTF::CrashOnOverflow::overflowed at /Builds/Debug/usr/local/include/wtf/CheckedArithmetic.h:103
#3	0x304c4735c in WTF::Vector<WebCore::KeyframeInterpolation::Keyframe const*, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::at at /Builds/Debug/usr/local/include/wtf/Vector.h:741
#4	0x304bf1930 in WTF::Vector<WebCore::KeyframeInterpolation::Keyframe const*, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::first at /Builds/Debug/usr/local/include/wtf/Vector.h:761
#5	0x307160990 in WebCore::AcceleratedEffect::apply at /Source/WebCore/platform/animation/AcceleratedEffect.cpp:409
#6	0x12cfde1c0 in WebKit::RemoteAnimation::apply at /Source/WebKit/UIProcess/RemoteLayerTree/RemoteAnimation.cpp:51
#7	0x12c197590 in WebKit::RemoteAnimationStack::computeValues at /Source/WebKit/UIProcess/RemoteLayerTree/RemoteAnimationStack.mm:193
#8	0x12c196fbc in WebKit::RemoteAnimationStack::initEffectsFromMainThread at /Source/WebKit/UIProcess/RemoteLayerTree/RemoteAnimationStack.mm:108
#9	0x12c1ab0ac in WebKit::RemoteLayerTreeNode::setAcceleratedEffectsAndBaseValues at /Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeNode.mm:330
#10	0x12afbab1c in WebKit::RemoteLayerTreePropertyApplier::applyPropertiesToLayer at /Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTreePropertyApplier.mm:508
#11	0x12afbb7a4 in WebKit::RemoteLayerTreePropertyApplier::applyProperties at /Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTreePropertyApplier.mm:562
#12	0x12c1a12e4 in WebKit::RemoteLayerTreeHost::updateLayerTree at /Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeHost.mm:230
#13	0x12c19fffc in WebKit::RemoteLayerTreeDrawingAreaProxy::commitLayerTreeTransaction(IPC::Connection&, WebKit::RemoteLayerTreeTransaction const&, WebKit::RemoteScrollingCoordinatorTransaction const&, std::__1::optional<WebKit::MainFrameData> const&, WebKit::PageData const&, WebCore::ProcessQualified<WebKit::MonotonicObjectIdentifier<WebKit::TransactionIDType>> const&)::$_0::operator()() const at /Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.mm:461
#14	0x12c19f2d0 in WebKit::RemoteLayerTreeDrawingAreaProxy::commitLayerTreeTransaction at /Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.mm:476
#15	0x12c19dc4c in WebKit::RemoteLayerTreeDrawingAreaProxy::commitLayerTree at /Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.mm:389

The failure happens here:

promise_test(async t => {
  const anim = target.animate([], {
      timeline: new ViewTimeline( { subject: target }),
      rangeStart: { rangeName: 'contain', offset: CSS.percent(0) },
      rangeEnd: { rangeName: 'contain', offset: CSS.percent(100) },
      duration: 'auto', fill: 'both'
    });

  await anim.ready;
  await waitForNextFrame();

  scroller.scrollTop = 750;
  await waitForNextFrame();
  assert_progress_equals(
      anim, 0.5, `Progress at contain 50% before effect change`);
  assert_opacity_equals(1, `Opacity at contain 50% before effect change`);

  anim.effect = new KeyframeEffect(target, [
      { offset: "cover 0%", opacity: 0 },
      { offset: "cover 100%", opacity: 1 }
    ], { duration: 'auto', fill: 'both' });
  await waitForNextFrame(); // <== CRASH HERE
  assert_progress_equals(
      anim, 0.5, `Progress at contain 50% after effect change`);
  assert_opacity_equals(0.5, `Opacity at contain 50% after effect change`);
}, 'Timeline offsets in programmatic keyframes resolved when updating ' +
   'the animation effect');

Must be something wrong with our accelerated effect update logic that yields an empty `interval.endpoints` in `AcceleratedEffect::apply()`. However, we do have `AcceleratedEffect::m_keyframes` holding two values.

[Antoine Quint]

The issue is that the computed offset is not resolved.

[Radar WebKit Bug Importer]

<rdar://problem/165549480>

[Antoine Quint]

Pull request: https://github.com/WebKit/WebKit/pull/54572

[EWS]

Committed 303651@main (7bb7290560c8): <https://commits.webkit.org/303651@main>

Reviewed commits have been landed. Closing PR #54572 and removing active labels.