← WebKit — 2026-W37
f2f5e1dff4dd0ccea5792e7395dce1dce3281db1 Canvas 2D context is permanently poisoned after a transient backing-store allocation failure
not a security fix
confidence 0.2
signal score 6.3
Source/WebCore/html
Classified as not security-relevant.
Triage note: CanvasRenderingContext2DBase::buffer() sets m_hasCreatedImageBuffer = true only after allocateImageBuffer() succeeds, so a failed allocation can be retried instead of latching a null/empty buffer state. A small state-consistency logic fix with no clear memory-safety or attacker-reachable security impact.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Triage note: CanvasRenderingContext2DBase::buffer() sets m_hasCreatedImageBuffer = true only after allocateImageBuffer() succeeds, so a failed allocation can be retried instead of latching a null/empty buffer state. A small state-consistency logic fix with no clear memory-safety or attacker-reachable security impact.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Structural signals: msg_medium (+2.0), msg_soft (+1.0), area:Source/WebCore/html (+2.0), surgical (+1.3)
Before / after
Loading diff…
On This Page