Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 5c9eba910d588525ef83eca05fb5ad76218d6d4c
https://github.com/WebKit/WebKit/commit/5c9eba910d588525ef83eca05fb5ad76218d6d4c
Author: Antoine Quint <[email protected]>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
A
LayoutTests/webanimations/accelerated-animation-suspension-crash-expected.txt
A LayoutTests/webanimations/accelerated-animation-suspension-crash.html
M Source/WebCore/animation/AnimationTimelinesController.cpp
Log Message:
-----------
[web-animations] use-after-free in
AnimationTimelinesController::suspendAnimations: m_timelines rehashes during
iteration when DocumentTimeline::suspendAnimations forces layout
https://bugs.webkit.org/show_bug.cgi?id=313961
rdar://175759878
Reviewed by Simon Fraser.
Calling `AnimationTimelinesController::suspendAnimations()` ends up calling
`DocumentTimeline::applyPendingAcceleratedAnimations()` which may trigger
a style recalculation for the targets of accelerated animations.
Such style recalculations may update the animation-to-timeline relationships
due to the `scroll-timeline` and `view-timeline` set of properties. This, in
turn, will cause `AnimationTimelinesController::suspendAnimations()` to have
the list of timelines it iterates over mutate. As such we now make a copy of
that list prior to iteration.
The new test was generated with AI assistance and adapted.
Test: webanimations/accelerated-animation-suspension-crash.html
*
LayoutTests/webanimations/accelerated-animation-suspension-crash-expected.txt:
Added.
* LayoutTests/webanimations/accelerated-animation-suspension-crash.html: Added.
* Source/WebCore/animation/AnimationTimelinesController.cpp:
(WebCore::AnimationTimelinesController::suspendAnimations):
Originally-landed-as: 305413.836@safari-7624-branch (f0d08798b749).
rdar://180429306
Canonical link: https://commits.webkit.org/316031@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
