← WebKit — 2026-W41
0ea1d42264fbf9b955bc9963724d93f965f5cb0d [HTML-in-Canvas] Hold a reference to the DisplayList recorder while painting a canvasDrawable layer
not a security fix
confidence 0.15
signal score 6.3
Source/WebCore/rendering
Classified as not security-relevant.
Triage note: Single-line change of `auto* recorder` to `RefPtr recorder` from canvasDrawableRecorder() in RenderLayer::paintLayer. SaferCPP lifetime hardening; no evidence of an actually triggered use-after-free in the diff.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Triage note: Single-line change of `auto* recorder` to `RefPtr recorder` from canvasDrawableRecorder() in RenderLayer::paintLayer. SaferCPP lifetime hardening; no evidence of an actually triggered use-after-free in the diff.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Structural signals: smartptr_member_added (+3.0), area:Source/WebCore/rendering (+2.0), surgical (+1.3)
Before / after
Loading diff…
On This Page