← WebKit Silent-Fix Report — 2026-W34
1603d30438c2628ceb6b413201a1c26b6e5cc192 Crash in RemoteSnapshot::applyFrame accessing null display list.
severity low
class LogicError
confidence 0.55
RemoteSnapshot drawToBitmap
Primitive: Null display-list/context dereference in GPU-process RemoteSnapshot::applyFrame
Triage note: drawToBitmap dereferenced image->context() without a null check and callers skipped completionHandler on early return; fix adds null-context guard and completionHandler({}), a web-triggerable GPU-process crash/hang.
Triage note: drawToBitmap dereferenced image->context() without a null check and callers skipped completionHandler on early return; fix adds null-context guard and completionHandler({}), a web-triggerable GPU-process crash/hang.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…