← WebKit Silent-Fix Report — 2026-W34
55c608d2b1b46d1ac0b40d093a8c6b5a69c16907 [scroll-animations] crash in `WebAnimation::bindingsRangeStart()`
severity medium
class LogicError
confidence 0.55
SingleAnimationRangeEdgeOffset
Primitive: Null dereference reading animation-range-start with calc() value
Triage note: toCSSNumericValue called tryPercentage()->value / tryFixed() which return null for a Calc offset, so animation-range-start:calc(...) then reading rangeStart null-deref crashed; fix switchOn handles the Calc case.
Triage note: toCSSNumericValue called tryPercentage()->value / tryFixed() which return null for a Calc offset, so animation-range-start:calc(...) then reading rangeStart null-deref crashed; fix switchOn handles the Calc case.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…