Disable incremental styling for animated ComputedStyles

For ComputedStyles that are affected by animation effects, we also store the corresponding *base style* on that animated ComputedStyle. This currently interacts poorly with incremental styling, since we copy the (potentially animated) ComputedStyle from the Element, which may already have the base style stored. StyleResolver::ApplyAnimatedStyle may then store *that* style as a base style again, potentially creating an infinite chain of base styles. This problem can't be reproduced with DCHECKs enabled, since we call ApplyBaseStyleNoCache to verify that the incremental ComputedStyle is equal to the ComputedStyle we would produce with a full resolution. However, the diff is blind to to fields which aren't generated, which includes the BaseData. Bug: 1313554 Change-Id: I24ce40b7ec9a54f818098b21e1125f0071c11b24 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3629398 Reviewed-by: Steinar H Gunderson <[email protected]> Commit-Queue: Anders Hartvoll Ruud <[email protected]> Cr-Commit-Position: refs/heads/main@{#1000332}
web-platform-tests · May 6, 2022 · f33ef39 · f33ef39
1 parent 7a88569
commit f33ef39
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/css/css-transitions/crashtests/transition-during-style-attr-mutation.html b/css/css-transitions/crashtests/transition-during-style-attr-mutation.html
@@ -0,0 +1,12 @@
+<!DOCTYPE HTML>
+<title>Don't crash when mutating style attribute with non-initial transition</title>
+<link rel="help" href="https://crbug.com/1313554">
+<style>
+  #foo { transition: --unset 1s linear; }
+</style>
+<div id=foo style="background-color:red">PASS if no crash</div>
+<script>
+foo.offsetTop;
+foo.style.backgroundColor = 'green';
+foo.offsetTop;
+</script>