Title: [233964] branches/safari-606-branch
Revision
233964
Author
[email protected]
Date
2018-07-18 19:00:35 -0700 (Wed, 18 Jul 2018)

Log Message

Cherry-pick r233903. rdar://problem/42345392

    Ensure timingFunctionForKeyframeAtIndex() can be used from setAnimatedPropertiesInStyle().
    https://bugs.webkit.org/show_bug.cgi?id=187637
    <rdar://problem/42157915>

    Reviewed by Dean Jackson.

    Source/WebCore:

    Test: webanimations/empty-keyframes-crash.html

    Unlike what we assumed, it is possible to have a non-declarative animation without any parsed keyframes.
    This can happen as a result of calling `Element.animate({}, …)`. In this case, we want to return a null
    value in timingFunctionForKeyframeAtIndex() so we update the call site in setAnimatedPropertiesInStyle()
    which is the only place where we didn't check for a null value and didn't know for sure that there would
    be parsed keyframes to rely on in the case of a WebAnimation instance.

    * animation/KeyframeEffectReadOnly.cpp:
    (WebCore::KeyframeEffectReadOnly::setAnimatedPropertiesInStyle):
    (WebCore::KeyframeEffectReadOnly::timingFunctionForKeyframeAtIndex):

    LayoutTests:

    Add a new test that would crash prior to this change.

    * webanimations/empty-keyframes-crash-expected.txt: Added.
    * webanimations/empty-keyframes-crash.html: Added.

    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233903 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Modified Paths

Added Paths

Diff

Modified: branches/safari-606-branch/LayoutTests/ChangeLog (233963 => 233964)


--- branches/safari-606-branch/LayoutTests/ChangeLog	2018-07-19 02:00:32 UTC (rev 233963)
+++ branches/safari-606-branch/LayoutTests/ChangeLog	2018-07-19 02:00:35 UTC (rev 233964)
@@ -1,5 +1,51 @@
 2018-07-18  Babak Shafiei  <[email protected]>
 
+        Cherry-pick r233903. rdar://problem/42345392
+
+    Ensure timingFunctionForKeyframeAtIndex() can be used from setAnimatedPropertiesInStyle().
+    https://bugs.webkit.org/show_bug.cgi?id=187637
+    <rdar://problem/42157915>
+    
+    Reviewed by Dean Jackson.
+    
+    Source/WebCore:
+    
+    Test: webanimations/empty-keyframes-crash.html
+    
+    Unlike what we assumed, it is possible to have a non-declarative animation without any parsed keyframes.
+    This can happen as a result of calling `Element.animate({}, …)`. In this case, we want to return a null
+    value in timingFunctionForKeyframeAtIndex() so we update the call site in setAnimatedPropertiesInStyle()
+    which is the only place where we didn't check for a null value and didn't know for sure that there would
+    be parsed keyframes to rely on in the case of a WebAnimation instance.
+    
+    * animation/KeyframeEffectReadOnly.cpp:
+    (WebCore::KeyframeEffectReadOnly::setAnimatedPropertiesInStyle):
+    (WebCore::KeyframeEffectReadOnly::timingFunctionForKeyframeAtIndex):
+    
+    LayoutTests:
+    
+    Add a new test that would crash prior to this change.
+    
+    * webanimations/empty-keyframes-crash-expected.txt: Added.
+    * webanimations/empty-keyframes-crash.html: Added.
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233903 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2018-07-17  Antoine Quint  <[email protected]>
+
+            Ensure timingFunctionForKeyframeAtIndex() can be used from setAnimatedPropertiesInStyle().
+            https://bugs.webkit.org/show_bug.cgi?id=187637
+            <rdar://problem/42157915>
+
+            Reviewed by Dean Jackson.
+
+            Add a new test that would crash prior to this change.
+
+            * webanimations/empty-keyframes-crash-expected.txt: Added.
+            * webanimations/empty-keyframes-crash.html: Added.
+
+2018-07-18  Babak Shafiei  <[email protected]>
+
         Cherry-pick r233888. rdar://problem/42345191
 
     Add completion handlers to TestRunner functions setStatisticsLastSeen(), setStatisticsPrevalentResource(), setStatisticsVeryPrevalentResource(), setStatisticsHasHadUserInteraction(), and setStatisticsHasHadNonRecentUserInteraction()

Added: branches/safari-606-branch/LayoutTests/webanimations/empty-keyframes-crash-expected.txt (0 => 233964)


--- branches/safari-606-branch/LayoutTests/webanimations/empty-keyframes-crash-expected.txt	                        (rev 0)
+++ branches/safari-606-branch/LayoutTests/webanimations/empty-keyframes-crash-expected.txt	2018-07-19 02:00:35 UTC (rev 233964)
@@ -0,0 +1 @@
+

Added: branches/safari-606-branch/LayoutTests/webanimations/empty-keyframes-crash.html (0 => 233964)


--- branches/safari-606-branch/LayoutTests/webanimations/empty-keyframes-crash.html	                        (rev 0)
+++ branches/safari-606-branch/LayoutTests/webanimations/empty-keyframes-crash.html	2018-07-19 02:00:35 UTC (rev 233964)
@@ -0,0 +1,30 @@
+<!DOCTYPE html><!-- webkit-test-runner [ enableWebAnimationsCSSIntegration=true ] -->
+<html>
+<head>
+<style>
+#hr1 {
+    transition: 1s;
+    background: url(data:image/gif;base64,);
+}
+</style>
+<script>
+
+if (window.testRunner)
+    testRunner.dumpAsText();
+
+function crash() {
+    var hr1 = document.getElementById("hr1");
+    var hr2 = document.getElementById("hr2");
+    document.all[2].appendChild(hr2);
+    var animation = document.createElement("hr3").animate({  }, 1);
+    var hr1_animation_effect = hr1.getAnimations()[0].effect;
+    animation.effect = hr1_animation_effect;
+}
+
+</script>
+</head>
+<body _onload_="crash()">
+<hr id="hr1"></hr>
+<hr id="hr2"></hr>
+</body>
+</html>

Modified: branches/safari-606-branch/Source/WebCore/ChangeLog (233963 => 233964)


--- branches/safari-606-branch/Source/WebCore/ChangeLog	2018-07-19 02:00:32 UTC (rev 233963)
+++ branches/safari-606-branch/Source/WebCore/ChangeLog	2018-07-19 02:00:35 UTC (rev 233964)
@@ -1,5 +1,58 @@
 2018-07-18  Babak Shafiei  <[email protected]>
 
+        Cherry-pick r233903. rdar://problem/42345392
+
+    Ensure timingFunctionForKeyframeAtIndex() can be used from setAnimatedPropertiesInStyle().
+    https://bugs.webkit.org/show_bug.cgi?id=187637
+    <rdar://problem/42157915>
+    
+    Reviewed by Dean Jackson.
+    
+    Source/WebCore:
+    
+    Test: webanimations/empty-keyframes-crash.html
+    
+    Unlike what we assumed, it is possible to have a non-declarative animation without any parsed keyframes.
+    This can happen as a result of calling `Element.animate({}, …)`. In this case, we want to return a null
+    value in timingFunctionForKeyframeAtIndex() so we update the call site in setAnimatedPropertiesInStyle()
+    which is the only place where we didn't check for a null value and didn't know for sure that there would
+    be parsed keyframes to rely on in the case of a WebAnimation instance.
+    
+    * animation/KeyframeEffectReadOnly.cpp:
+    (WebCore::KeyframeEffectReadOnly::setAnimatedPropertiesInStyle):
+    (WebCore::KeyframeEffectReadOnly::timingFunctionForKeyframeAtIndex):
+    
+    LayoutTests:
+    
+    Add a new test that would crash prior to this change.
+    
+    * webanimations/empty-keyframes-crash-expected.txt: Added.
+    * webanimations/empty-keyframes-crash.html: Added.
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233903 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2018-07-17  Antoine Quint  <[email protected]>
+
+            Ensure timingFunctionForKeyframeAtIndex() can be used from setAnimatedPropertiesInStyle().
+            https://bugs.webkit.org/show_bug.cgi?id=187637
+            <rdar://problem/42157915>
+
+            Reviewed by Dean Jackson.
+
+            Test: webanimations/empty-keyframes-crash.html
+
+            Unlike what we assumed, it is possible to have a non-declarative animation without any parsed keyframes.
+            This can happen as a result of calling `Element.animate({}, …)`. In this case, we want to return a null
+            value in timingFunctionForKeyframeAtIndex() so we update the call site in setAnimatedPropertiesInStyle()
+            which is the only place where we didn't check for a null value and didn't know for sure that there would
+            be parsed keyframes to rely on in the case of a WebAnimation instance.
+
+            * animation/KeyframeEffectReadOnly.cpp:
+            (WebCore::KeyframeEffectReadOnly::setAnimatedPropertiesInStyle):
+            (WebCore::KeyframeEffectReadOnly::timingFunctionForKeyframeAtIndex):
+
+2018-07-18  Babak Shafiei  <[email protected]>
+
         Cherry-pick r233883. rdar://problem/42345112
 
     Correctly adjust scroll offsets when a page is zoomed

Modified: branches/safari-606-branch/Source/WebCore/animation/KeyframeEffectReadOnly.cpp (233963 => 233964)


--- branches/safari-606-branch/Source/WebCore/animation/KeyframeEffectReadOnly.cpp	2018-07-19 02:00:32 UTC (rev 233963)
+++ branches/safari-606-branch/Source/WebCore/animation/KeyframeEffectReadOnly.cpp	2018-07-19 02:00:35 UTC (rev 233964)
@@ -1162,7 +1162,8 @@
         if (startKeyframeIndex) {
             if (auto iterationDuration = timing()->iterationDuration()) {
                 auto rangeDuration = (endOffset - startOffset) * iterationDuration.seconds();
-                transformedDistance = timingFunctionForKeyframeAtIndex(startKeyframeIndex.value())->transformTime(intervalDistance, rangeDuration);
+                if (auto* timingFunction = timingFunctionForKeyframeAtIndex(startKeyframeIndex.value()))
+                    transformedDistance = timingFunction->transformTime(intervalDistance, rangeDuration);
             }
         }
 
@@ -1181,19 +1182,18 @@
         return m_parsedKeyframes[index].timingFunction.get();
 
     auto effectAnimation = animation();
+    if (is<DeclarativeAnimation>(effectAnimation)) {
+        // If we're dealing with a CSS Animation, the timing function is specified either on the keyframe itself.
+        if (is<CSSAnimation>(effectAnimation)) {
+            if (auto* timingFunction = m_blendingKeyframes[index].timingFunction())
+                return timingFunction;
+        }
 
-    // If we didn't have parsed keyframes, we must be dealing with a declarative animation.
-    ASSERT(is<DeclarativeAnimation>(effectAnimation));
-
-    // If we're dealing with a CSS Animation, the timing function is specified either on the keyframe itself,
-    // or failing that on the backing Animation object which defines the default for all keyframes.
-    if (is<CSSAnimation>(effectAnimation)) {
-        if (auto* timingFunction = m_blendingKeyframes[index].timingFunction())
-            return timingFunction;
+        // Failing that, or for a CSS Transition, the timing function is inherited from the backing Animation object.
+        return downcast<DeclarativeAnimation>(effectAnimation)->backingAnimation().timingFunction();
     }
 
-    // Failing that, or for a CSS Transition, the timing function is inherited from the backing Animation object. 
-    return downcast<DeclarativeAnimation>(effectAnimation)->backingAnimation().timingFunction();
+    return nullptr;
 }
 
 void KeyframeEffectReadOnly::updateAcceleratedAnimationState()
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to