[Webkit-unassigned] [Bug 188519] [Web Animations] Crash under AnimationTimeline::cancelOrRemoveDeclarativeAnimation()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=188519

--- Comment #4 from Antoine Quint <graouts at apple.com> ---
In this case we would crash because we blindly assumed an animation that was found in the previous style must be in the list of running animations but in fact it could have been removed already due to the element being removed from the DOM. So when we iterate over names of animations that were found in the previous style but not in the new style, we must make a null check to ensure that there is an animation to remove. Adding an ASSERT() in AnimationTimeline::cancelOrRemoveDeclarativeAnimation() will also clarify the contract here.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180813/a6457ed1/attachment-0001.html>