Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8256a3cb6c19ae63a9cb946a7179450883e1d04b
https://github.com/WebKit/WebKit/commit/8256a3cb6c19ae63a9cb946a7179450883e1d04b
Author: Ahmad Saleem <[email protected]>
Date: 2026-07-12 (Sun, 12 Jul 2026)
Changed paths:
M Source/WebCore/svg/SVGLengthContext.cpp
Log Message:
-----------
Null-deref of documentElement() when resolving root-font-relative SVG lengths
https://bugs.webkit.org/show_bug.cgi?id=318852
rdar://181677854
Reviewed by Taher Ali.
SVGLengthContext::removeZoomFromFontOrRootFontRelativeLength() dereferenced
Document::documentElement() without a null check when resolving a
root-font-relative unit (e.g. rem/rlh). documentElement() can return null
(document without a root element, or one being torn down), so this could
crash during length/style resolution.
The sibling helper rootRenderStyleForLengthResolving() already guards this
exact access with `if (!rootElement || !rootElement->renderer())`. Guard
documentElement() before reading its renderer, mirroring the sibling helper.
* Source/WebCore/svg/SVGLengthContext.cpp:
(WebCore::SVGLengthContext::removeZoomFromFontOrRootFontRelativeLength const):
Canonical link: https://commits.webkit.org/317004@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
