Skip to content

Commit

Permalink
[layout] Fix null-deref when attempting to mark a scrollbar for layout
Browse files Browse the repository at this point in the history
Custom scrollbar parts are weird in that they don't have a parent.
We'd unconditionally attempt to access their containing block
causing a null-deref.

Fixed: 355016913
Change-Id: I9c32cf7efc00543021111bb3eaa1e8488052264f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5760674
Reviewed-by: David Grogan <[email protected]>
Commit-Queue: Ian Kilpatrick <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1337141}
  • Loading branch information
bfgeek authored and chromium-wpt-export-bot committed Aug 5, 2024
1 parent 2f9e207 commit 84d708b
Showing 1 changed file with 10 additions and 0 deletions.
10 changes: 10 additions & 0 deletions css/css-scrollbars/invalid-needs-layout-crash.html
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
<!DOCTYPE html>
<style>
#target::-webkit-scrollbar { position: absolute; }
#target.crash::-webkit-scrollbar { right: 0 }
</style>
<div id="target" style="width: 100px; height: 100px; overflow: auto;"><div style="height: 200px;"></div></div>
<script>
document.body.offsetTop;
document.getElementById('target').classList.add('crash');
</script>

0 comments on commit 84d708b

Please sign in to comment.