← Chrome — 2026-W40
b6610de43b21f2f48419fdf6dbf8d97413c77fb4 [Blink] Guard against null provider in GetElementImage()
severity low
class LogicError
confidence 0.45
signal score 6
third_party/blink/renderer/core/
Primitive: null-pointer dereference of CanvasNon2DResourceProvider::Create() result
Triage note: GetElementImage() dereferenced Create() unconditionally though it returns nullptr when dest_size exceeds max_texture_size or GPU context is lost. Adds a null guard. Crash/DoS, not memory-corruption.
Triage note: GetElementImage() dereferenced Create() unconditionally though it returns nullptr when dest_size exceeds max_texture_size or GPU context is lost. Adds a null guard. Crash/DoS, not memory-corruption.
Structural signals: null_guard (+1.2), msg_soft (+1.0), area:third_party/blink/renderer/core/ (+2.5), surgical (+1.3)
Commit message
[Blink] Guard against null provider in GetElementImage()
Before / after
Loading diff…
On This Page