Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 0bd0161c3f7a52fcbedeef3b6c9fc62eed83e7e3
https://github.com/WebKit/WebKit/commit/0bd0161c3f7a52fcbedeef3b6c9fc62eed83e7e3
Author: Ahmad Saleem <[email protected]>
Date: 2026-09-06 (Sun, 06 Sep 2026)
Changed paths:
M Source/WebCore/loader/NavigationAction.h
Log Message:
-----------
Cherry-pick 320316@main (ba64b8f51316).
https://bugs.webkit.org/show_bug.cgi?id=322905
NavigationAction::m_type is left uninitialized by the default constructor
https://bugs.webkit.org/show_bug.cgi?id=322905
rdar://186162338
Reviewed by Chris Dumez.
NavigationAction's user-provided default constructor doesn't zero-fill
members, and m_type is the only one without an in-class initializer, so
it is left indeterminate. DocumentLoader default-constructs
m_triggeringAction and its type() is read (via triggeringAction())
before a real action is assigned, which is undefined behavior.
Initialize m_type to NavigationType::Other, matching the other members.
* Source/WebCore/loader/NavigationAction.h:
Canonical link: https://commits.webkit.org/320316@main
Canonical link: https://commits.webkit.org/317695.202@webkitglib/2.54
Commit: e0bd97cd00e13324e8a574cd11b26b4338e4f69e
https://github.com/WebKit/WebKit/commit/e0bd97cd00e13324e8a574cd11b26b4338e4f69e
Author: Justin Michaud <[email protected]>
Date: 2026-09-06 (Sun, 06 Sep 2026)
Changed paths:
A LayoutTests/fast/images/gif-frame-outside-logical-screen-expected.txt
A LayoutTests/fast/images/gif-frame-outside-logical-screen.html
A LayoutTests/fast/images/resources/gif-frame-outside-logical-screen.gif
M Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp
Log Message:
-----------
Cherry-pick 320531@main (e513b5fcd857).
https://bugs.webkit.org/show_bug.cgi?id=321752
[non-cocoa][fuzz] GIF image decoder should not have negative width/height
https://bugs.webkit.org/show_bug.cgi?id=321752
Reviewed by Patrick Griffis and Claudio Saavedra.
GIFImageDecoder::initFrameBuffer() clamped a frame rect that extends past
the
canvas by subtracting the frame's offset from the canvas extent. A GIF's
logical
screen size is only published for the first frame, so a later frame's
offset can
itself be past the canvas, which made that subtraction negative and left the
backing store with a frame rect of negative width or height. Intersect with
the
canvas instead, which clamps to an empty rect.
* LayoutTests/fast/images/gif-frame-outside-logical-screen-expected.txt:
Added.
* LayoutTests/fast/images/gif-frame-outside-logical-screen.html: Added.
* LayoutTests/fast/images/resources/gif-frame-outside-logical-screen.gif:
Added.
* Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp:
(WebCore::GIFImageDecoder::initFrameBuffer):
Canonical link: https://commits.webkit.org/320531@main
Canonical link: https://commits.webkit.org/317695.203@webkitglib/2.54
Compare: https://github.com/WebKit/WebKit/compare/03eda1e66c76...e0bd97cd00e1
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
