Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 3c0232a5d33e17eeec3db8c24e5f7bf171cf8742
https://github.com/WebKit/WebKit/commit/3c0232a5d33e17eeec3db8c24e5f7bf171cf8742
Author: Ahmad Saleem <[email protected]>
Date: 2026-09-04 (Fri, 04 Sep 2026)
Changed paths:
M Source/WebCore/html/CanvasNoiseInjection.cpp
Log Message:
-----------
CanvasNoiseInjection misclassifies the bottom-left pixel due to an off-by-one
in the bottom-row check
https://bugs.webkit.org/show_bug.cgi?id=323405
rdar://186640624
Reviewed by Gerald Squelart.
boundingNeighbors() classifies the bottom row with
pixelIndex > (size.height() - 1) * size.width()
but the last row spans indices [(H-1)*W, H*W-1], so the test should be
">=". With ">", the bottom-left pixel (pixelIndex == (H-1)*W) is not
recognized as being in the bottom row, and consequently not recognized
as the bottom-left corner. The top-row check on the line above already
uses the correct "<" form; this makes the bottom-row check symmetric.
This has no observable effect on output: the misclassified pixel falls
into the left-column branch, whose below-neighbor is out of bounds, so
areColorsRelated() returns false and the bounding colors stay at their
defaults -- identical to what the corner early-return produces. It also
does not trip the isIndexInBounds() assertion, because the out-of-bounds
below-index equals bufferSize exactly and the "+ 3" probe is
short-circuited. This is a correctness/clarity fix; no test is added
because the pixel output is byte-for-byte unchanged and any test would
pass without the fix.
* Source/WebCore/html/CanvasNoiseInjection.cpp:
(WebCore::boundingNeighbors):
Canonical link: https://commits.webkit.org/320510@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
