9fb68176b4a1a71b9bd5711c6cbce0e6088e9c52  Skip cull rect update when a layer doesn't have LocalBorderBoxProperties

The bug at a glance

Adds a defensive early-return so the cull-rect updater skips layers that unexpectedly lack LocalBorderBoxProperties; the pre-patch code would access absent paint properties, most plausibly hitting a DCHECK/null-deref and crashing the renderer (inferred), a stability/DoS concern with no corruption shown.

A defender cares because certain layout/paint states (beyond frame throttling and display locking) can leave a layer without LocalBorderBoxProperties; the cull-rect update then dereferences properties that are not present, a renderer crash the author could not fully explain.

Root cause

During the cull-rect update walk, UpdateForDescendants/recursion builds a Context from object.FirstFragment()’s paint properties, which assumes LocalBorderBoxProperties exist (normally guaranteed by PaintPropertyTreeBuilder). The author found cases where some layers lack LocalBorderBoxProperties despite not being frame-throttled or display-locked, so the subsequent access of those properties would fail (inferred DCHECK/null-dereference). The fix adds if (!object.FirstFragment().HasLocalBorderBoxProperties()) return; right after the existing IsFragmentLessBox() guard, skipping the cull-rect update for such layers.

Key code

Skip cull-rect update for layers lacking LocalBorderBoxProperties

+  if (!object.FirstFragment().HasLocalBorderBoxProperties()) {
+    return;
+  }

Patch walkthrough

• third_party/blink/renderer/core/paint/cull_rect_updater.cc — Adds an early return when the object’s first fragment has no LocalBorderBoxProperties, immediately after the IsFragmentLessBox() check. This guards the following Context construction and property access from operating on a layer whose paint properties were never built, avoiding the resulting crash/CHECK failure (inferred).

Background

CullRectUpdater — Blink paint-phase component that computes per-layer cull rects (the region worth painting) by walking the layer/fragment tree.

LocalBorderBoxProperties — Paint-property-tree state attached to a fragment describing its transform/clip/effect context; normally built by PaintPropertyTreeBuilder but can be absent for throttled, display-locked, or (here) unexplained layers.

FragmentData / FirstFragment — Per-object fragment paint data; accessing LocalBorderBoxProperties when HasLocalBorderBoxProperties() is false is invalid.

Vulnerability window

1. Reachability — Reachable from ordinary web content in a stock build via layout/paint of pages that produce layers lacking LocalBorderBoxProperties (specific layout conditions, author unsure of exact cause).
2. Trigger — The cull-rect update visits such a layer and proceeds past the fragment-less-box guard into property-dependent logic.
3. Primitive — Access of the absent LocalBorderBoxProperties, most plausibly a DCHECK/null-dereference causing a renderer crash (inferred).
4. Escalation — No escalation beyond renderer DoS/stability; no memory-corruption primitive demonstrated (inferred).

Proof of concept

Conceptually, craft a page whose layout/paint leaves one or more PaintLayers without LocalBorderBoxProperties (the exact triggering conditions were not fully identified by the author) so the cull-rect update reaches a layer whose paint properties were never built. The outcome is a crash during paint, not a controllable corruption.

Exploitation

1. Setup — Construct DOM/CSS that yields a layer without LocalBorderBoxProperties during the paint-property build (inferred, conditions unclear).
2. Trigger — Force a cull-rect update (scroll/layout change) that visits that layer (inferred).
3. Crash — Property access on the missing LocalBorderBoxProperties crashes the renderer (inferred).

Detection & hunting

For defenders and detection engineers:

• grep for FirstFragment()/FragmentData accesses of LocalBorderBoxProperties() not guarded by HasLocalBorderBoxProperties() — Audit paint-tree walkers for unguarded assumption that paint properties always exist.
• Renderer crash reports in cull_rect_updater.cc / CullRectUpdater during paint — Correlate crashes with pages hitting throttling/display-lock or unusual layer states.

Audit directions

• Other callers in core/paint that read LocalBorderBoxProperties without a Has check* — Add the same guard where a layer may legitimately lack paint properties.
• PaintPropertyTreeBuilder conditions that skip building LocalBorderBoxProperties — Enumerate all states (beyond throttling/display-lock) that can omit the properties so consumers handle them.