[Webkit-unassigned] [Bug 228954] REGRESSION (r275756): Accelerated animations freeze when invalidating layout with shadow dom

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=228954

Antti Koivisto <koivisto at iki.fi> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |koivisto at iki.fi

--- Comment #4 from Antti Koivisto <koivisto at iki.fi> ---
The test replaces the children of the shadow host that has animation running. This triggers unconditional render tree rebuild, including the host, and interrupts the animation.

  * frame #0: 0x00000001436a7210 WebCore`WebCore::SlotAssignment::didChangeSlot(this=0x000000010ba20a68, slotAttrValue=0x0000000132a80008, shadowRoot=0x0000000104b6abc0) at SlotAssignment.cpp:311:5
    frame #1: 0x000000014356aa34 WebCore`WebCore::ShadowRoot::didChangeDefaultSlot(this=0x0000000104b6abc0) at SlotAssignment.h:131:27
    frame #2: 0x000000014356a704 WebCore`WebCore::Element::childrenChanged(this=0x0000000104b6aa60, change=0x000000016b4879d0) at Element.cpp:2700:25
    frame #3: 0x00000001439314bc WebCore`WebCore::HTMLElement::childrenChanged(this=0x0000000104b6aa60, change=0x000000016b4879d0) at HTMLElement.cpp:892:20
    frame #4: 0x00000001434333e0 WebCore`void WebCore::executeNodeInsertionWithScriptAssertion<WebCore::ContainerNode::appendChildWithoutPreInsertionValidityCheck(WebCore::Node&)::$_4>(containerNode=0x0000000104b6aa60, child=0x000000010597e490, source=API, replacedAllChildren=No, doNodeInsertion=(anonymous class) @ 0x000000016b487b10)::$_4) at ContainerNode.cpp:228:23
    frame #5: 0x0000000143430998 WebCore`WebCore::ContainerNode::appendChildWithoutPreInsertionValidityCheck(this=0x0000000104b6aa60, newChild=0x0000000105982360) at ContainerNode.cpp:766:9
    frame #6: 0x00000001434331b4 WebCore`WebCore::ContainerNode::appendChild(this=0x0000000104b6aa60, newChild=0x0000000105982360) at ContainerNode.cpp:732:12
    frame #7: 0x000000014383f1a0 WebCore`WebCore::replaceChildrenWithFragment(container=0x0000000104b6aa60, fragment=0x000000016b487e30) at markup.cpp:1397:34
    frame #8: 0x000000014356e6c4 WebCore`WebCore::Element::setInnerHTML(this=0x0000000104b6aa60, html=0x000000016b487f90) at Element.cpp:3305:12
    frame #9: 0x000000014137dce4 WebCore`WebCore::setJSElement_innerHTMLSetter(this=0x000000016b487f68)::'lambda'()::operator()() const at JSElement.cpp:2956:21

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210811/7faada52/attachment.htm>