eliott/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird synced 2026-04-25 17:25:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

LibWeb: Skip unstyled descendants in animation updates

Browse Source 
Animation updates propagate inherited animated values by walking the
animated target's subtree and calling `recompute_inherited_style()` on
each element. Elements inserted during the same rendering update may
not have computed properties yet, which violates an existing assertion,
causing a crash.

Fix this by skipping unstyled descendants during this walk. The
subsequent recursive style update computes their style from scratch.
This commit is contained in:
Tim Ledbetter
2026-04-22 08:35:14 +01:00
committed by Andreas Kling
parent f426f021ef
commit 06ee7bc532
Notes: github-actions[bot] 2026-04-22 08:16:00 +00:00 
Author: https://github.com/tcl3
Commit: https://github.com/LadybirdBrowser/ladybird/commit/06ee7bc532b
Pull-request: https://github.com/LadybirdBrowser/ladybird/pull/9030
2 changed files with 27 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
Tests/LibWeb/Crash/CSS/animation-subtree-append-unstyled-child.html Normal file
View File

@@ -0,0 +1,25 @@
<!DOCTYPE html>
<html class="test-wait">
<style>
@keyframes anim { from { opacity: 1 } to { opacity: 0.5 } }
#target { animation: anim 10s infinite; }
</style>
<div id="target"></div>
<script>
const animation = target.getAnimations()[0];
function waitForAnimationTick() {
if (animation.currentTime === null || animation.currentTime === 0) {
requestAnimationFrame(waitForAnimationTick);
return;
}
target.appendChild(document.createElement("div"));
requestAnimationFrame(() => {
document.documentElement.classList.remove("test-wait");
});
}
requestAnimationFrame(waitForAnimationTick);
</script>
</html>