Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8a41f40f585d05ac986b233b18738c9b819c1f74
https://github.com/WebKit/WebKit/commit/8a41f40f585d05ac986b233b18738c9b819c1f74
Author: Ahmad Saleem <[email protected]>
Date: 2026-09-16 (Wed, 16 Sep 2026)
Changed paths:
M Source/WebCore/platform/graphics/transforms/TransformState.cpp
Log Message:
-----------
TransformState::operator= is not self-assignment safe and destroys the
accumulated transform
https://bugs.webkit.org/show_bug.cgi?id=324311
rdar://187540904
Reviewed by Simon Fraser.
TransformState::operator= sets m_accumulatedTransform to nullptr before
checking other.m_accumulatedTransform to decide whether to clone it. On a
self-assignment (state = state), &other == this, so nulling our own
unique_ptr also nulls other's; the subsequent guard then sees nullptr and
never rebuilds the matrix, silently discarding the accumulated transform.
Guard against self-assignment by returning early when this == &other.
* Source/WebCore/platform/graphics/transforms/TransformState.cpp:
(WebCore::TransformState::operator=):
Canonical link: https://commits.webkit.org/321258@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
