← WebKit — 2026-W38
68af3881b5ea3760c73b9eda843777768777acd2 Transforming a table row group misplaces absolutely positioned children
severity medium
class UAF
confidence 0.5
signal score 6.3
Source/WebCore/rendering
Primitive: out-of-flow boxes left in a containing block's positioned-objects list on style change of a non-RenderBlock
Triage note: Moves removeOutOfFlowBoxesIfNeededOnStyleChange from RenderBlock::styleWillChange into RenderBox::styleWillChange, delegating to nearestNonAnonymousContainingBlockIncludingSelf() (now a RenderElement method); plausibly fixes stale out-of-flow box references in the positioned-objects list for elements that are not RenderBlocks, but the diff alone does not establish a concrete attacker-reachable memory bug.
Triage note: Moves removeOutOfFlowBoxesIfNeededOnStyleChange from RenderBlock::styleWillChange into RenderBox::styleWillChange, delegating to nearestNonAnonymousContainingBlockIncludingSelf() (now a RenderElement method); plausibly fixes stale out-of-flow box references in the positioned-objects list for elements that are not RenderBlocks, but the diff alone does not establish a concrete attacker-reachable memory bug.
Structural signals: smartptr_member_added (+3.0), area:Source/WebCore/rendering (+2.0), surgical (+1.3)
Commit message
Transforming a table row group misplaces absolutely positioned children
https://bugs.webkit.org/show_bug.cgi?id=324019
<rdar://problem/187252945>
Reviewed by Antti Koivisto.
A box that starts or stops being the containing block for out-of-flow descendants has to take them off the block that currently holds them.
Only RenderBlock and RenderInline called removeOutOfFlowBoxesIfNeededOnStyleChange, so a table section gaining a transform left its
absolutely positioned descendants registered on the old containing block and they were laid out against it.
* LayoutTests/imported/w3c/web-platform-tests/css/css-transforms/transformed-table-section-containing-block-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/css/css-transforms/transformed-table-section-containing-block.html: Added.
* Source/WebCore/rendering/RenderBlock.cpp:
(WebCore::RenderBlock::styleWillChange):
* Source/WebCore/rendering/RenderBox.cpp:
(WebCore::RenderBox::styleWillChange):
* Source/WebCore/rendering/RenderElement.h:
* Source/WebCore/rendering/RenderObject.cpp:
(WebCore::RenderElement::nearestNonAnonymousContainingBlockIncludingSelf const):
(WebCore::RenderObject::containingBlockForPositionType):
Canonical link: https://commits.webkit.org/321065@main
Before / after
Loading diff…
On This Page