Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 105dc95023539a5cea55723e7a0256d887756752
https://github.com/WebKit/WebKit/commit/105dc95023539a5cea55723e7a0256d887756752
Author: Antoine Quint <[email protected]>
Date: 2026-03-13 (Fri, 13 Mar 2026)
Changed paths:
A
LayoutTests/webanimations/unregister-named-scroll-timeline-crash-expected.txt
A LayoutTests/webanimations/unregister-named-scroll-timeline-crash.html
Log Message:
-----------
[scroll-animations] add a test for 309059@main
https://bugs.webkit.org/show_bug.cgi?id=309897
rdar://172477112
Reviewed by Alan Baradlay.
Using AI assistance, demonstrate the speculative fix landed in 309059@main is
indeed
fixing a test that reproduced the crash prior to the change. Here's what would
happen
within this test:
1. Two nested scrollable elements (#outer and #inner) both declare
scroll-timeline-name: --foo.
Since #inner is closer in the tree, the #target animation attaches to
#inner's scroll timeline.
2. After the animation is ready, we change #inner to have
`scroll-timeline-name: none`. This will
change the timeline on the #target animation to #outer's scroll timeline.
3. After forcing style resolution,
`StyleOriginatedTimelinesController::unregisterNamedTimeline()`
is called with `--foo` as the name and `#inner` as the styleable. Inside
that function, we get
the timeline generated by the `--foo` / `#inner` combo registered in
m_nameToTimelineMap, remove
it, and proceed to iterate over that timeline's animations to ensure their
timeline is updated
after that timeline's removal.
Prior to 309059@main, we iterated over the animation list by reference, but the
timeline update
would change that list, yielding a crash as we attempt to iterate over members
that weren't there
anymore.
With 309059@main, we make a copy of the list, ensuring mutation does not occur
to it.
*
LayoutTests/webanimations/unregister-named-scroll-timeline-crash-expected.txt:
Added.
* LayoutTests/webanimations/unregister-named-scroll-timeline-crash.html: Added.
Canonical link: https://commits.webkit.org/309210@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
