← WebKit Silent-Fix Report — 2026-W21
537cc2c75c ASSERTION FAILED: m_renderBlock.ptr() != subtreeScrollbarChangesState->subtreeRoot.ptr().
severity low
class UAF
confidence 0.45
WebCore rendering/layout
Primitive: re-entrant relayout on a subtree root
Triage note: Layout re-entrancy crash fix (ASSERT on subtreeRoot); plausible use-after-free during relayout.
Triage note: Layout re-entrancy crash fix (ASSERT on subtreeRoot); plausible use-after-free during relayout.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…