Bug 188519 - [Web Animations] Crash under AnimationTimeline::cancelOrRemoveDeclarativeAnimation()
Summary: [Web Animations] Crash under AnimationTimeline::cancelOrRemoveDeclarativeAnim...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Animations (show other bugs)
Version: Other
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Antoine Quint
URL:
Keywords: InRadar
: 188253 (view as bug list)
Depends on:
Blocks:
 
Reported: 2018-08-13 10:09 PDT by Antoine Quint
Modified: 2018-08-14 08:15 PDT (History)
4 users (show)

See Also:

Attachments
Patch (5.82 KB, patch)
2018-08-14 07:23 PDT, Antoine Quint 		eric.carlson: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Antoine Quint 2018-08-13 10:09:30 PDT 
When loading www.seloger.com we crash in AnimationTimeline::cancelOrRemoveDeclarativeAnimation() with a null `animation` parameter.
Comment 1 Antoine Quint 2018-08-13 10:10:31 PDT 
We also have a crash in this function in webkit.org/b/188253.
Comment 2 Radar WebKit Bug Importer 2018-08-13 10:11:16 PDT 
<rdar://problem/43237889>
Comment 3 Antoine Quint 2018-08-13 10:12:00 PDT 
I also came across webkit.org/b/188518 trying to figure out why the site was crashing. To reproduce this crash, we need to comment out the ASSERT() from that other bug.
Comment 4 Antoine Quint 2018-08-13 11:24:40 PDT 
In this case we would crash because we blindly assumed an animation that was found in the previous style must be in the list of running animations but in fact it could have been removed already due to the element being removed from the DOM. So when we iterate over names of animations that were found in the previous style but not in the new style, we must make a null check to ensure that there is an animation to remove. Adding an ASSERT() in AnimationTimeline::cancelOrRemoveDeclarativeAnimation() will also clarify the contract here.
Comment 5 Antoine Quint 2018-08-13 11:29:55 PDT 
*** Bug 188253 has been marked as a duplicate of this bug. ***
Comment 6 Antoine Quint 2018-08-14 07:23:45 PDT 
Created attachment 347072 [details]
Patch
Comment 7 Antoine Quint 2018-08-14 08:15:14 PDT 
Committed r234848: <https://trac.webkit.org/changeset/234848>