[composite-bgcolor-animation] Null check on GetBackgroundColorPaintImageGenerator
When calling GetBackgroundColorPaintImageGenerator on local_root,
we should always performa a null-check for local_root because the
it could have been detached.
This CL does the null-check. A test case is added, exactly the case
when the local_root is detached. There is no crash with the fix.
Bug: 1215879
Change-Id: Id2401dae593da9ee960e5e5336c4d4876eb39f79
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2951382
Commit-Queue: Xida Chen <xidachen@chromium.org>
Reviewed-by: Robert Flack <flackr@chromium.org>
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#891421}
diff --git a/css/css-backgrounds/animations/background-color-animation-removed-element-crash.html b/css/css-backgrounds/animations/background-color-animation-removed-element-crash.html
new file mode 100644
index 0000000..f8408fb
--- /dev/null
+++ b/css/css-backgrounds/animations/background-color-animation-removed-element-crash.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<link rel="help" href="https://drafts.csswg.org/css-backgrounds-3/#background-color">
+<iframe id="foo"></iframe>
+<div id="bar"></div>
+
+<script>
+ $ = document.querySelector.bind(document);
+ var target = document.getElementById("bar");
+ target.animate([{"backgroundColor":"blue"},{"backgroundColor":"green"}], {"duration":10});
+ $('iframe').contentDocument.documentElement.appendChild(target);
+ $('#foo').remove();
+</script>
\ No newline at end of file
