Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4847c476a8210ac1f67eec533605e8df4bb26602
https://github.com/WebKit/WebKit/commit/4847c476a8210ac1f67eec533605e8df4bb26602
Author: Kristian Monsen <[email protected]>
Date: 2026-09-05 (Sat, 05 Sep 2026)
Changed paths:
A
LayoutTests/fast/css/css-anchor-position/position-visibility-line-break-anchor-crash-expected.txt
A
LayoutTests/fast/css/css-anchor-position/position-visibility-line-break-anchor-crash.html
M Source/WebCore/style/AnchorPositionEvaluator.cpp
Log Message:
-----------
Anchor positioned element with position-visibility crashes when its default
anchor is a <br>
https://bugs.webkit.org/show_bug.cgi?id=321364
rdar://184019783
Reviewed by Alan Baradlay.
The crash happened because the code assumed a RenderBoxModelObject "default
anchor" could only ever be one of two concrete types: RenderBox or RenderInline.
That assumption is false. RenderBoxModelObject actually has three concrete
subclasses: RenderBox, RenderInline, and RenderLineBreak (used for <br>/<wbr>).
Anchor registration
(AnchorPositionEvaluator::isAnchor) doesn't restrict which of these can carry
anchor-name — any of the three qualifies. So when the default anchor resolved
to a <br>,
dynamicDowncast<RenderBox> correctly returned null, and the code fell through
to downcast<RenderInline>, which is a RELEASE_ASSERT(is<RenderInline>(source)).
Since the object was
actually a RenderLineBreak, that assertion failed and WTFCrashWithInfo aborted
the process — the crash was WebKit itself refusing to proceed with a type it
never anticipated, not
memory corruption.
The fix resolves it by handling all three real subclasses explicitly.
Test:
fast/css/css-anchor-position/position-visibility-line-break-anchor-crash.html
*
LayoutTests/fast/css/css-anchor-position/position-visibility-line-break-anchor-crash-expected.txt:
Added.
*
LayoutTests/fast/css/css-anchor-position/position-visibility-line-break-anchor-crash.html:
Added.
* Source/WebCore/style/AnchorPositionEvaluator.cpp:
(WebCore::Style::AnchorPositionEvaluator::isDefaultAnchorInvisibleOrClippedByInterveningBoxes):
Canonical link: https://commits.webkit.org/320577@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
