Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 142b64feb347c77afd640466504abb2ca52039de
https://github.com/WebKit/WebKit/commit/142b64feb347c77afd640466504abb2ca52039de
Author: Simon Fraser <[email protected]>
Date: 2026-02-19 (Thu, 19 Feb 2026)
Changed paths:
M Source/WebCore/rendering/RenderLayerBacking.cpp
M Source/WebCore/rendering/RenderLayerBacking.h
Log Message:
-----------
Null deref under RenderLayerBacking::updateOverflowControlsLayers()
https://bugs.webkit.org/show_bug.cgi?id=308230
rdar://150330340
Reviewed by Alan Baradlay.
Crash data suggest that we can hit a null de-ref under
`m_owningLayer.page().scrollingCoordinator()()`
in `RenderLayerBacking::updateOverflowControlsLayers()` when tearing down the
render tree.
Fix by avoid this call altogether. We know from the order in `~RenderLayer()`
that
we've always cleared the scrollable area before clearing the backing, thus at
teardown
this code will never hit `scrollableAreaScrollbarLayerDidChange()`. So add a
simpler
`clearOverflowControlsLayers()` to be called from `~RenderLayerBacking()` that
just
destroys the layers.
* Source/WebCore/rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::~RenderLayerBacking):
(WebCore::RenderLayerBacking::clearOverflowControlsLayers):
* Source/WebCore/rendering/RenderLayerBacking.h:
Canonical link: https://commits.webkit.org/307858@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
