Bug 314822

Summary:	SubtreeScrollbarChangesStateScope can outlive LayoutScope
Product:	WebKit	Reporter:	Sammy Gill <sgill26>
Component:	Layout and Rendering	Assignee:	Sammy Gill <sgill26>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	bfulgham, simon.fraser, webkit-bug-importer, zalan
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Sammy Gill

Reported 2026-05-14 09:00:04 PDT

Currently in RenderBlock::layout LayoutScope can get destroyed before SubtreeScrollbarChangesStateScope. We probably want this to happen the other way around and make sure LayoutScope is the last thing destroyed otherwise it can put us in a weird state

Attachments
Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2026-05-14 09:00:18 PDT

<rdar://problem/177077505>

Sammy Gill

Comment 2 2026-05-14 09:09:34 PDT

Pull request: https://github.com/WebKit/WebKit/pull/64813

EWS

Comment 3 2026-05-15 12:06:08 PDT

Committed 313323@main (f9ade7a024fb): <https://commits.webkit.org/313323@main> Reviewed commits have been landed. Closing PR #64813 and removing active labels.

Note You need to log in before you can comment on or make changes to this bug.