← WebKit — 2026-W36
4847c476a8210ac1f67eec533605e8df4bb26602 Anchor positioned element with position-visibility crashes when its default anchor is a <br>
severity medium
class TypeConfusion
confidence 0.65
signal score 6.67
Source/WebCore/style
patch-now
Primitive: Unchecked downcast<RenderInline> on a RenderLineBreak default anchor
Triage note: isDefaultAnchorInvisibleOrClippedByInterveningBoxes unconditionally did downcast<RenderInline>(*defaultAnchor).linesVisualOverflowBoundingBox(); the fix uses dynamicDowncast and adds a RenderLineBreak branch, so a <br> used as a CSS anchor no longer gets reinterpreted as RenderInline. Attacker-reachable bad-cast via CSS anchor-positioning.
Triage note: isDefaultAnchorInvisibleOrClippedByInterveningBoxes unconditionally did downcast<RenderInline>(*defaultAnchor).linesVisualOverflowBoundingBox(); the fix uses dynamicDowncast and adds a RenderLineBreak branch, so a <br> used as a CSS anchor no longer gets reinterpreted as RenderInline. Attacker-reachable bad-cast via CSS anchor-positioning.
Structural signals: smartptr_member_added (+4.87), msg_strong (+3.0), msg_noise (-2.5), surgical (+1.3)
Commit message
Anchor positioned element with position-visibility crashes when its default anchor is a <br>
https://bugs.webkit.org/show_bug.cgi?id=321364
rdar://184019783
Reviewed by Alan Baradlay.
The crash happened because the code assumed a RenderBoxModelObject "default anchor" could only ever be one of two concrete types: RenderBox or RenderInline.
That assumption is false. RenderBoxModelObject actually has three concrete subclasses: RenderBox, RenderInline, and RenderLineBreak (used for <br>/<wbr>). Anchor registration
(AnchorPositionEvaluator::isAnchor) doesn't restrict which of these can carry anchor-name — any of the three qualifies. So when the default anchor resolved to a <br>,
dynamicDowncast<RenderBox> correctly returned null, and the code fell through to downcast<RenderInline>, which is a RELEASE_ASSERT(is<RenderInline>(source)). Since the object was
actually a RenderLineBreak, that assertion failed and WTFCrashWithInfo aborted the process — the crash was WebKit itself refusing to proceed with a type it never anticipated, not
memory corruption.
The fix resolves it by handling all three real subclasses explicitly.
Test: fast/css/css-anchor-position/position-visibility-line-break-anchor-crash.html
* LayoutTests/fast/css/css-anchor-position/position-visibility-line-break-anchor-crash-expected.txt: Added.
* LayoutTests/fast/css/css-anchor-position/position-visibility-line-break-anchor-crash.html: Added.
* Source/WebCore/style/AnchorPositionEvaluator.cpp:
(WebCore::Style::AnchorPositionEvaluator::isDefaultAnchorInvisibleOrClippedByInterveningBoxes):
Canonical link: https://commits.webkit.org/320577@main
Before / after
Loading diff…
On This Page