Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9d94c4a1b1dfb70159f036f89e9390ac1ddddae3
https://github.com/WebKit/WebKit/commit/9d94c4a1b1dfb70159f036f89e9390ac1ddddae3
Author: Ahmad Saleem <[email protected]>
Date: 2026-09-13 (Sun, 13 Sep 2026)
Changed paths:
M Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
Log Message:
-----------
GraphicsLayerCA::m_tileCoverage is read uninitialized by changeLayerTypeTo()
https://bugs.webkit.org/show_bug.cgi?id=324097
rdar://187313650
Reviewed by Chris Dumez.
m_tileCoverage (a plain unsigned TileCoverage) had no in-class initializer
and was absent from the constructor's member-init list, so changeLayerTypeTo()
reads an indeterminate value at GraphicsLayerCA.cpp:4947 and forwards it to a
freshly-created TiledBacking. This is undefined behavior.
Initialize m_tileCoverage to TiledBacking::CoverageForVisibleArea in the
GraphicsLayerCA constructor, matching TileController's own default. The
constructor lives in the .cpp, which already includes TiledBacking.h, so we
can use the named enumerator directly rather than a bare 0 in the header
(GraphicsLayerCA.h does not include TiledBacking.h).
* Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp:
(WebCore::GraphicsLayerCA::GraphicsLayerCA):
Canonical link: https://commits.webkit.org/321036@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
