← WebKit — 2026-W39
7799f34a1444dcbf7d2635b7cc591a70a2794c6d MESSAGE_CHECK in establishLayerTreeScrollingRelations because scrolling nodes can be orphaned when an overflow scroll proxy node is destroyed.
not a security fix
confidence 0.2
signal score 9.59
Source/WebCore/rendering
Classified as not security-relevant.
Triage note: Mostly refactor passing RenderLayerCompositor& instead of ScrollingCoordinator*; adds unparentChildrenAndDestroyScrollingNode() which marks child layers for reattachment and m_scrollingNodeToLayerMap tracking, plus removeNode()+return in ScrollingTree, and softens MESSAGE_CHECK_BASE to ASSERT+continue. A scrolling-tree lifecycle correctness change with no demonstrable memory-safety primitive in the diff.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Triage note: Mostly refactor passing RenderLayerCompositor& instead of ScrollingCoordinator*; adds unparentChildrenAndDestroyScrollingNode() which marks child layers for reattachment and m_scrollingNodeToLayerMap tracking, plus removeNode()+return in ScrollingTree, and softens MESSAGE_CHECK_BASE to ASSERT+continue. A scrolling-tree lifecycle correctness change with no demonstrable memory-safety primitive in the diff.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Structural signals: smartptr_member_added (+3.0), null_guard (+2.59), msg_medium (+2.0), area:Source/WebCore/rendering (+2.0)
Before / after
Loading diff…
On This Page