Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9510cbdd84529cbaf291ed6b395ccd5d55731102
https://github.com/WebKit/WebKit/commit/9510cbdd84529cbaf291ed6b395ccd5d55731102
Author: Sean Patterson <[email protected]>
Date: 2026-08-05 (Wed, 05 Aug 2026)
Changed paths:
A
LayoutTests/fast/html/details-display-contents-scrollable-content-crash-expected.txt
A
LayoutTests/fast/html/details-display-contents-scrollable-content-crash.html
M Source/WebCore/rendering/RenderLayerScrollableArea.cpp
Log Message:
-----------
Null-deref crash in RenderElement::resolvePseudoElementStyle() when a
<details> element has `display: contents` and its ::details-content establishes
a scrollable area
https://bugs.webkit.org/show_bug.cgi?id=320447
rdar://183445758
Reviewed by Simon Fraser.
rendererForScrollbar() maps a renderer inside a user agent shadow root to its
shadow host's renderer, so that scrollbar pseudo element styles are resolved
against the host. It returned the host's renderer unconditionally, but a host
with `display: contents` has no renderer. Its user agent shadow content can
still establish a scrollable area, so all three callers dereferenced null.
A <details> is exactly that case: its ::details-content is a slot in the user
agent shadow root, so giving the <details> `display: contents` and the
::details-content non-visible overflow crashed the WebContent process while
resolving the scroll corner style during render tree construction. This is the
standard way to build an animated disclosure widget whose summary participates
in a parent grid, so it is reachable from ordinary content.
Null check the host's renderer and fall back to the renderer establishing the
scrollable area, which is the pre-existing behavior for content outside a user
agent shadow root. Only the null case changes behavior.
* Source/WebCore/rendering/RenderLayerScrollableArea.cpp:
(WebCore::rendererForScrollbar): The host is not guaranteed to have a renderer.
It has none when it is `display: contents`, even though its user agent shadow
content may still establish a scrollable area. Fall back to the renderer
establishing the scrollable area rather than returning null, since the callers
all dereference the result to resolve the scrollbar pseudo element styles
against it: updateScrollCornerStyle(), updateResizerStyle() and
createScrollbar().
* LayoutTests/fast/html/details-display-contents-scrollable-content-crash.html:
Added.
*
LayoutTests/fast/html/details-display-contents-scrollable-content-crash-expected.txt:
Added.
Covers all three call sites: a scroll corner, a resizer (`resize: both`) and
scrollbar creation (`overflow: scroll` with overflowing content). Crashes
without the fix, passes with it.
Canonical link: https://commits.webkit.org/318661@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
