Bug 95517

Summary: ASSERTion failure when SVG element is removed from document and readded
Product: WebKit Reporter: Tim Horton <thorton>
Component: SVGAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: beidson, dino, fmalita, zimmermann
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
repro
none
patch beidson: review+

Description Tim Horton 2012-08-30 17:24:25 PDT
See attached test case: if you have an <svg> element in an HTML page, then remove it and add it again, we assert:

ASSERTION FAILED: !m_beginTime
/Volumes/SSD/src/WebKit/OpenSource/Source/WebCore/svg/animation/SMILTimeContainer.cpp(91) : void WebCore::SMILTimeContainer::begin()
1   0x103e43962 WebCore::SMILTimeContainer::begin()
2   0x104082648 WebCore::SVGSVGElement::insertedInto(WebCore::ContainerNode*)
3   0x102b04494 WebCore::ChildNodeInsertionNotifier::notifyNodeInsertedIntoDocument(WebCore::Node*)
4   0x102b00c25 WebCore::ChildNodeInsertionNotifier::notify(WebCore::Node*)
5   0x102afd69a WebCore::updateTreeAfterInsertion(WebCore::ContainerNode*, WebCore::Node*, bool)
6   0x102afd0cd WebCore::ContainerNode::appendChild(WTF::PassRefPtr<WebCore::Node>, int&, bool)
7   0x1039be15a WebCore::Node::appendChild(WTF::PassRefPtr<WebCore::Node>, int&, bool)

This is because m_beginTime wasn't cleared when the element was removed, so it's still set from this element's previous call to begin().

I have a patch, however, I wonder what behavior is expected? Should animations continue from where they were, or should they restart from the beginning when the <svg> is added to the document?

<rdar://problem/12175583>
Comment 1 Tim Horton 2012-08-30 17:27:19 PDT
Created attachment 161595 [details]
repro
Comment 2 Tim Horton 2012-08-30 17:36:27 PDT
The SVG Animation spec says that the timeline is relative to "document begin", which is "the exact time at which the svg element's SVGLoad event is triggered", which only happens once, so I guess we can't just reset the time container.
Comment 3 Dean Jackson 2012-08-30 17:38:30 PDT
(In reply to comment #0)

> I have a patch, however, I wonder what behavior is expected? Should animations continue from where they were, or should they restart from the beginning when the <svg> is added to the document?

Seems like this is undefined in the spec. I vote for restarting.
Comment 4 Tim Horton 2012-08-31 14:58:58 PDT
Re-reading the spec, it's pretty clear that they're not supposed to restart (that the TimeContainer starts when SVGLoad happens and therefore cannot be reset), so maybe the assertion is just bogus. Let's see if any tests are depending on this behavior.
Comment 5 Tim Horton 2012-08-31 15:55:37 PDT
(In reply to comment #4)
> Re-reading the spec, it's pretty clear that they're not supposed to restart (that the TimeContainer starts when SVGLoad happens and therefore cannot be reset), so maybe the assertion is just bogus. Let's see if any tests are depending on this behavior.

Firefox and Opera agree with ^^ (and do not restart the animation).

However, our current behavior is actually *more* broken -- the animation doesn't resume when the <svg> is readded.
Comment 6 Tim Horton 2012-08-31 15:59:56 PDT
(In reply to comment #5)
> (In reply to comment #4)
> > Re-reading the spec, it's pretty clear that they're not supposed to restart (that the TimeContainer starts when SVGLoad happens and therefore cannot be reset), so maybe the assertion is just bogus. Let's see if any tests are depending on this behavior.
> 
> Firefox and Opera agree with ^^ (and do not restart the animation).

They also don't pause the animation while the <svg> is out-of-document, so that's kind of odd... (it jumps when it gets readded)
Comment 7 Tim Horton 2012-08-31 17:40:57 PDT
Created attachment 161799 [details]
patch
Comment 8 Tim Horton 2012-09-04 11:31:14 PDT
http://trac.webkit.org/changeset/127474