Bug 314105 – [threaded-animations] animating `offset-path` between `margin-box` and `stroke-box` yields a crash under `AcceleratedEffectValues::AcceleratedEffectValues(WebCore::RenderStyle const&, WebCore::IntRect const&, WebCore::RenderLayerModelObject const*)`

• Component: Animations
• Status: RESOLVED FIXED

[Antoine Quint]

Creating this simple animation:

    const animation = document.getElementById("target").animate(
        { transform: "translateX(100px)", offsetPath: ["margin-box", "stroke-box"] },
        1000
    );

… yields a crash under `AcceleratedEffectValues::AcceleratedEffectValues(WebCore::RenderStyle const&, WebCore::IntRect const&, WebCore::RenderLayerModelObject const*)`.

[Antoine Quint]

rdar://176159562

[Antoine Quint]

Created attachment 479479 [details]
Test

Attaching a test that reproduces the issue and is ready to use as a layout test.

[Antoine Quint]

This was caused by 310214@main.

[Sam Weinig]

Is this really a security issue? It's accessing an std::optional when it's not engaged. Doesn't that cleanly abort?

[Sam Weinig]

Created attachment 479483 [details]
Fix

Attaching fix.

[Sam Weinig]

Pull request: https://github.com/WebKit/WebKit/pull/64516

[EWS]

Committed 312881@main (1b01b6d32c39): <https://commits.webkit.org/312881@main>

Reviewed commits have been landed. Closing PR #64516 and removing active labels.