I hit this crash when loading Epiphany's new tab page yesterday. We have 24 reports of it:
Thread no. 1 (10 frames)
#0 WebCore::Animation::animationsMatch at /usr/src/debug/webkitgtk-2.14.1/Source/WebCore/platform/animation/Animation.cpp:138
#1 WebCore::Animation::operator== at /usr/src/debug/webkitgtk-2.14.1/Source/WebCore/platform/animation/Animation.h:168
#2 WebCore::Animation::operator!= at /usr/src/debug/webkitgtk-2.14.1/Source/WebCore/platform/animation/Animation.h:169
#3 WebCore::AnimationList::operator== at /usr/src/debug/webkitgtk-2.14.1/Source/WebCore/platform/animation/AnimationList.cpp:59
#4 WTF::arePointingToEqualData<std::unique_ptr<WebCore::AnimationList, std::default_delete<WebCore::AnimationList> > > at /usr/src/debug/webkitgtk-2.14.1/Source/WTF/wtf/PointerComparison.h:33
#5 WebCore::StyleRareNonInheritedData::operator== at /usr/src/debug/webkitgtk-2.14.1/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp:258
#6 WebCore::DataRef<WebCore::StyleRareNonInheritedData>::operator== at /usr/src/debug/webkitgtk-2.14.1/Source/WebCore/rendering/style/DataRef.h:51
#7 WebCore::RenderStyle::operator== at /usr/src/debug/webkitgtk-2.14.1/Source/WebCore/rendering/style/RenderStyle.cpp:305
#8 WebCore::RenderStyle::operator!= at /usr/src/debug/webkitgtk-2.14.1/Source/WebCore/rendering/style/RenderStyle.h:549
#9 WebCore::Style::determineChange at /usr/src/debug/webkitgtk-2.14.1/Source/WebCore/style/StyleChange.cpp:63
There is a detailed backtrace attached to comment #1 in the downstream bug.
(In reply to comment #0)
> There is a detailed backtrace attached to comment #1 in the downstream bug.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00007fd56123212b in WebCore::Animation::animationsMatch (this=0x7fd54b2b1d80, other=..., matchPlayStates=matchPlayStates@entry=true) at /usr/src/debug/webkitgtk-2.14.1/Source/WebCore/platform/animation/Animation.cpp:138
138 && *(m_timingFunction.get()) == *(other.m_timingFunction.get())
Can you attach the HTML/CSS that triggers this?
(In reply to comment #2)
> Can you attach the HTML/CSS that triggers this?
I can attach the HTML/CSS generated by my overview page (which could be slightly different from what it was yesterday if my top 10 visited sites have changed since yesterday; possible since I've cleared my history recently), but it is some rare race and definitely not a reliable reproducer.
Created attachment 295153 [details]
HTML of my overview page
Created attachment 295154 [details]
CSS for the page
Can you reproduce the crash with this HTML and CSS?
(In reply to comment #6)
> Can you reproduce the crash with this HTML and CSS?
No, I do not have a reproducer. I just happen to remember it crashed yesterday displaying about:overview (which does not even contain any animations).
FWIW there is a FIXME in TreeResolver::createAnimatedElementUpdate one line beneath the crash:
update.change = determineChange(rendererToUpdate->style(), *animatedStyle);
// If animation forces render tree reconstruction pass the original style. The animation will be applied on renderer construction.
// FIXME: We should always use the animated style here.
update.style = update.change == Detach ? WTFMove(newStyle) : WTFMove(animatedStyle);
But that looks probably unrelated.
*** Bug 167706 has been marked as a duplicate of this bug. ***
This also happens randomly (and rarely) in the middle of playing YouTube videos.
Here's a different crash when playing a YouTube video. I presume it's a related issue.
Created attachment 360138 [details]
Updated backtrace (2019)
*** Bug 166923 has been marked as a duplicate of this bug. ***
*** Bug 197985 has been marked as a duplicate of this bug. ***
(In reply to Michael Catanzaro from comment #12)
> *** Bug 166923 has been marked as a duplicate of this bug. ***
Zan had a test patch in this bug.