← WebKit — 2026-W39
03cc81b72b0cdaa1764ff13b80a025bea8a82b0d [HTML-in-Canvas] Support the HTMLCanvasElement attribute layoutsubtree
not a security fix
confidence 0.1
signal score 7.67
Source/WebCore/html
Classified as not security-relevant.
Triage note: Adds RenderTreeBuilderCanvas, RenderHTMLCanvas::canHaveChildren/layout/nodeAtPoint/innerRenderer and layoutsubtree handling gated on settings().htmlInCanvasEnabled(); net-new feature, not a fix.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Triage note: Adds RenderTreeBuilderCanvas, RenderHTMLCanvas::canHaveChildren/layout/nodeAtPoint/innerRenderer and layoutsubtree handling gated on settings().htmlInCanvasEnabled(); net-new feature, not a fix.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Structural signals: smartptr_member_added (+6.47), null_guard (+1.2), area:Source/WebCore/html (+2.0), large_churn (-2.0)
Before / after
Loading diff…
On This Page