← WebKit Silent-Fix Report — 2026-W23
bf80e3eedd686c0fe2ecce39b3143e6279a89103 [grid layout] Don't call viewportContentsChanged() from scroll updates during render tree layout
severity medium
class LogicError
confidence 0.55
WebCore Rendering
Primitive: Reentrant viewportContentsChanged() from scroll during grid render-tree layout
Triage note: RenderLayerScrollableArea::scrollTo called frameView().viewportContentsChanged() while inside render-tree layout, causing a reentrant-layout crash (grid + vertical-rl overflow + transformed child); fix guards the call with !layoutContext().isInRenderTreeLayout().
Triage note: RenderLayerScrollableArea::scrollTo called frameView().viewportContentsChanged() while inside render-tree layout, causing a reentrant-layout crash (grid + vertical-rl overflow + transformed child); fix guards the call with !layoutContext().isInRenderTreeLayout().
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…