[Web Animations] REGRESSION (r236809): crash under AnimationTimeline::updateCSSAnimat...
authorgraouts@webkit.org <graouts@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 5 Oct 2018 10:57:43 +0000 (10:57 +0000)
committergraouts@webkit.org <graouts@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 5 Oct 2018 10:57:43 +0000 (10:57 +0000)
commitffba9732170011d5cbf539685d13124520470739
treed8b575aaf330397f4fb67a23f97e23126db5b238
parent05943b295a4e5d7ea41cca45c45021ea023a3acc
[Web Animations] REGRESSION (r236809): crash under AnimationTimeline::updateCSSAnimationsForElement()
https://bugs.webkit.org/show_bug.cgi?id=190307
<rdar://problem/45009901>

Reviewed by Dean Jackson.

Source/WebCore:

We could crash with an invalid access to cssAnimationsByName since cancelOrRemoveDeclarativeAnimation() already
does the job of clearing the m_elementToCSSAnimationByName entry for this particular element if there are no
animations targeting it anymore. This started happening in r236809 when we switched from a simple call to to cancel()
to a call to cancelOrRemoveDeclarativeAnimation(). We can safely remove the removal here since cancelOrRemoveDeclarativeAnimation()
will already have performed this task safely if needed.

* animation/AnimationTimeline.cpp:
(WebCore::AnimationTimeline::updateCSSAnimationsForElement):

LayoutTests:

This test was also crashing even though it should not have been using the new animation engine. Adding the
flag to opt into the legacy animation engine.

* legacy-animation-engine/animations/animation-shorthand-removed.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@236871 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/legacy-animation-engine/animations/animation-shorthand-removed.html
Source/WebCore/ChangeLog
Source/WebCore/animation/AnimationTimeline.cpp