haikuwebkit/LayoutTests/svg/animations/animate-and-remove-target-e...

34 lines
824 B
HTML
Raw Permalink Normal View History

Crash when removing the target element while animating its attributes https://bugs.webkit.org/show_bug.cgi?id=202247 Reviewed by Darin Adler. Source/WebCore: If SMIL is animating a CSS attribute, there is a chance the animation is ended while it is being started or progressed. For that reason, the member SVGAnimateElementBase::m_animator has to be made RefPtr and it has to be be protected in resetAnimatedType() and calculateAnimatedValue(). While SMILTimeContainer::updateAnimations() is calling progress() for the scheduled animation elements, SMILTimeContainer::unschedule() might get called if processing an animation causes events to be dispatched. For that reason we need to copy the scheduled animations Vector before processing them so we avoid changing the Vector while looping through its items. Remove the guard SMILTimeContainer::m_preventScheduledAnimationsChanges which was added in r129670 for debugging purposes. In some situations, the scheduled animations map could be modified out from under some of the functions of SMILTimeContainer. Test: svg/animations/animate-and-remove-target-element.html * svg/SVGAnimateElementBase.cpp: (WebCore::SVGAnimateElementBase::resetAnimatedType): (WebCore::SVGAnimateElementBase::calculateAnimatedValue): * svg/SVGAnimateElementBase.h: * svg/SVGElement.cpp: (WebCore::SVGElement::createAnimator): * svg/SVGElement.h: * svg/animation/SMILTimeContainer.cpp: (WebCore::SMILTimeContainer::schedule): (WebCore::SMILTimeContainer::unschedule): (WebCore::SMILTimeContainer::setElapsed): (WebCore::SMILTimeContainer::sortByPriority): (WebCore::SMILTimeContainer::processAnimations): (WebCore::SMILTimeContainer::processScheduledAnimations): (WebCore::SMILTimeContainer::updateAnimations): (WebCore::SMILTimeContainer::~SMILTimeContainer): Deleted. * svg/animation/SMILTimeContainer.h: * svg/animation/SVGSMILElement.cpp: (WebCore::SVGSMILElement::calculateNextProgressTime const): * svg/properties/SVGAnimatedPropertyAccessorImpl.h: * svg/properties/SVGAnimatedPropertyAnimatorImpl.h: * svg/properties/SVGAnimatedPropertyPairAccessorImpl.h: * svg/properties/SVGAnimatedPropertyPairAnimator.h: * svg/properties/SVGAnimatedPropertyPairAnimatorImpl.h: * svg/properties/SVGAttributeAnimator.h: * svg/properties/SVGMemberAccessor.h: (WebCore::SVGMemberAccessor::createAnimator const): * svg/properties/SVGPrimitivePropertyAnimator.h: (WebCore::SVGPrimitivePropertyAnimator::create): * svg/properties/SVGPropertyAnimatorFactory.h: (WebCore::SVGPropertyAnimatorFactory::createAnimator): * svg/properties/SVGPropertyOwnerRegistry.h: * svg/properties/SVGPropertyRegistry.h: * svg/properties/SVGValuePropertyAnimatorImpl.h: * svg/properties/SVGValuePropertyListAnimatorImpl.h: LayoutTests: * svg/animations/animate-and-remove-target-element-expected.txt: Added. * svg/animations/animate-and-remove-target-element.html: Added. Canonical link: https://commits.webkit.org/215889@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@250488 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2019-09-29 05:16:58 +00:00
<body>
<p>Passes if it does not crash.</p>
<form>
<select id="select" onfocus="onFocus()" multiple></select>
<keygen/>
</form>
<svg id="svg">
<animate attributeName="opacity" onbegin="onBegin()"/>
</svg>
<script>
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.waitUntilDone();
}
window.addEventListener('load', (event) => {
select.autofocus = true;
});
function onFocus(){
svg.remove();
}
function onBegin(){
select.removeAttribute("multiple");
svg.setCurrentTime(9);
setTimeout(() => {
if (window.testRunner)
testRunner.notifyDone();
});
}
</script>
</body>