diff --git a/ui/android/overscroll_refresh.h b/ui/android/overscroll_refresh.h index aaaaaaaaaa..bbbbbbbbbb 100644 --- a/ui/android/overscroll_refresh.h +++ b/ui/android/overscroll_refresh.h @@ -124,9 +124,12 @@ class UI_ANDROID_EXPORT OverscrollRefresh { kEnabled, } scroll_consumption_state_; - float viewport_width_; - float scroll_begin_x_; - float scroll_begin_y_; + // Initialize to zero so a renderer-triggered OnOverscrolled() that arrives + // before the first OnFrameUpdated() (i.e. before any RenderFrameMetadata) + // does not read uninitialized heap bytes at the in_x_direction branch. + float viewport_width_ = 0.f; + float scroll_begin_x_ = 0.f; + float scroll_begin_y_ = 0.f; const float edge_width_; // in px const raw_ptr handler_; bool touchpad_overscroll_history_navigation_enabled_ = false;