Bug 303253 – [threaded-animations] WPT test `scroll-animations/scroll-timelines/setting-timeline.tentative.html` crashes with "Threaded Scroll-driven Animations" enabled

• Status: RESOLVED
• Resolution: FIXED
• Component: Animations

[Antoine Quint]

The following command crashes WebKitTestRunner:

run-webkit-tests --debug --experimental-feature ThreadedScrollDrivenAnimationsEnabled=true imported/w3c/web-platform-tests/scroll-animations/scroll-timelines/setting-timeline.tentative.html

Here's the relevant chunk of the call stack:

```
#0	0x3002d5708 in WTFCrashWithInfo at /Builds/Debug/usr/local/include/wtf/Assertions.h:974
#1	0x304c647cc in WebCore::WebAnimationTime::operator- at /OpenSource/Source/WebCore/animation/WebAnimationTime.cpp:182
#2	0x304c646f0 in WebCore::WebAnimation::currentTime at /OpenSource/Source/WebCore/animation/WebAnimation.cpp:512
#3	0x304c57414 in WebCore::WebAnimation::currentTime at /OpenSource/Source/WebCore/animation/WebAnimation.cpp:489
#4	0x304c55854 in WebCore::WebAnimation::playState at /OpenSource/Source/WebCore/animation/WebAnimation.cpp:784
#5	0x304bf04b0 in WebCore::KeyframeEffect::isRunningAccelerated at /OpenSource/Source/WebCore/animation/KeyframeEffect.cpp:1665
#6	0x304bf802c in WebCore::KeyframeEffect::StackMembershipMutationScope::~StackMembershipMutationScope at /OpenSource/Source/WebCore/animation/KeyframeEffect.cpp:3069
#7	0x304bef4c8 in WebCore::KeyframeEffect::StackMembershipMutationScope::~StackMembershipMutationScope at /OpenSource/Source/WebCore/animation/KeyframeEffect.cpp:3061
#8	0x304bef26c in WebCore::KeyframeEffect::updateEffectStackMembership at /OpenSource/Source/WebCore/animation/KeyframeEffect.cpp:1530
#9	0x304bef154 in WebCore::KeyframeEffect::animationTimelineDidChange at /OpenSource/Source/WebCore/animation/KeyframeEffect.cpp:1505
#10	0x304c633f4 in WebCore::WebAnimation::setTimelineInternal at /OpenSource/Source/WebCore/animation/WebAnimation.cpp:384
#11	0x304c56d68 in WebCore::WebAnimation::setTimeline at /OpenSource/Source/WebCore/animation/WebAnimation.cpp:314
#12	0x304c6390c in WebCore::WebAnimation::setBindingsTimeline at /OpenSource/Source/WebCore/animation/WebAnimation.cpp:260
```

This happens for this specific subtest:

```
promise_test(async t => {
  const animation = createAnimation(t);
  const scrollTimeline = createScrollTimeline(t);
  animation.timeline = scrollTimeline;
  await animation.ready;
  await updateScrollPosition(scrollTimeline, 100);

  animation.timeline = document.timeline;
  assert_times_equal(animation.currentTime, 100);
}, 'Transitioning from a scroll timeline to a document timeline on a running ' +
   'animation preserves currentTime');
```

It's not obvious why this only crashes with "Threaded Scroll-driven Animations" enabled

[Antoine Quint]

Presumably `WebAnimation::m_startTime` hasn't been re-resolved as the test runs `animation.timeline = document.timeline` and we enter `KeyframeEffect::updateEffectStackMembership()` which calls into `WebAnimation::currentTime()`. This code path is only used with "Threaded Scroll-driven Animations" enabled.

[Radar WebKit Bug Importer]

<rdar://problem/165550231>

[Antoine Quint]

Pull request: https://github.com/WebKit/WebKit/pull/54573

[EWS]

Committed 303645@main (d7fdc6d1513b): <https://commits.webkit.org/303645@main>

Reviewed commits have been landed. Closing PR #54573 and removing active labels.