commit 6f17a2b92ac8f8b64d5390e07c98906295aea044
parent f6a371ec91f9923f2e4c6f2b78bdbeddb56712e5
Author: John An <johna@microsoft.com>
Date: Thu, 8 Jan 2026 17:37:23 +0000
Bug 2009027 [wpt PR 57048] - Remove obsolete NodeRareData::InvalidateAssociatedAnimationEffects, a=testonly
Automatic update from web-platform-tests
Remove obsolete NodeRareData::InvalidateAssociatedAnimationEffects
It is possible to trigger an illegal nested scroll animation
invalidation using a pseudoelement. If a scroll animation target has a
pseudoelement child, then removing the pseudoelement's content in a
twice nested requestAnimationFrame call will cause a DCHECK.
The DCHECK happens like this:
- The requestAnimationFrame triggers a style recalc
- When the target element recalculates its style, it clears its
PseudoElements.
- Clearing the PseudoElements triggers associated animation effect
invalidation on the parent element.
- The animation invalidation sets 'needs style recalc' on the
associated node.
- The nested style recalc causes the DCHECK
This scroll animation invalidation logic was meant to account for
scroller sibling elements using that scroller as a scroll-timeline.
However that is no longer possible which means only scroller
descendants can use that scroller. This means we can remove
InvalidateAssociatedAnimationEffects because invalidating the
descendants of an element being removed is useless.
Bug: 467705351
Change-Id: I219bb60c6a98ba0ef936ac4b3d2f998a96e99e0a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7263687
Reviewed-by: Rune Lillesveen <futhark@chromium.org>
Reviewed-by: Kevin Ellis <kevers@chromium.org>
Commit-Queue: John An <johna@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#1565862}
--
wpt-commits: 3d6ee6411d7f1101609cc4c0555edd4eaf8d2bbf
wpt-pr: 57048
Diffstat:
1 file changed, 36 insertions(+), 0 deletions(-)
diff --git a/testing/web-platform/tests/css/css-pseudo/crashtests/pseudoelement-removal-with-scroll-timeline-crash.html b/testing/web-platform/tests/css/css-pseudo/crashtests/pseudoelement-removal-with-scroll-timeline-crash.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<html>
+<style>
+ #target::after {
+ content: "content";
+ animation: fade-scroll linear;
+ animation-timeline: scroll(inline);
+ }
+
+ #target.off::after {
+ content: none;
+ }
+
+ @keyframes fade-scroll {
+ from { opacity: 1; }
+ to { opacity: 0.3; }
+ }
+</style>
+</head>
+<body>
+<div id="target"></div>
+<script>
+ // This test ensures that removing the content of a pseudo-element whose
+ // parent element is the target of a scroll-timeline animation during style
+ // recalc doesn't crash.
+ // Perform content removal after layout pass to ensure scroll animation is
+ // registered.
+ requestAnimationFrame(() => {
+ requestAnimationFrame(() => {
+ target.className = 'off';
+ });
+ });
+</script>
+</body>
+</html>
+\ No newline at end of file
