See bug 186536 comment 41 for a repro case with Google drive and stack trace. With the patch from bug 186536, the crash happens here: case AnimationState::PausedWaitTimer: ASSERT(input == AnimationStateInput::PlayStateRunning); ASSERT(paused()); // Update the times m_startTime = m_startTime.value(0) + beginAnimationUpdateTime() - m_pauseTime.value_or(0); m_pauseTime = std::nullopt; Checking other potential misuses of uninitialized std::optional members in AnimationBase::updateStateMachine(), I only see one possible other place. I'll just use value_or(0) for these two places to workaround these issues. Antoine Quint mentioned that the old animation code is going to be removed soon, so the actual way we fix these should not be a big deal...
Created attachment 344410 [details] Patch
Comment on attachment 344410 [details] Patch Clearing flags on attachment: 344410 Committed r233574: <https://trac.webkit.org/changeset/233574>
All reviewed patches have been landed. Closing bug.
<rdar://problem/41885732>