Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f5722de1f7688c554746a1a040463b76dd581005
https://github.com/WebKit/WebKit/commit/f5722de1f7688c554746a1a040463b76dd581005
Author: Nikolas Zimmermann <[email protected]>
Date: 2026-06-22 (Mon, 22 Jun 2026)
Changed paths:
M Source/WebCore/rendering/RenderLayerModelObject.cpp
Log Message:
-----------
[LBSE] Guard the SVG DOM-order cache dirtying on the transform-attribute fast
path
https://bugs.webkit.org/show_bug.cgi?id=317577
Reviewed by Rob Buis.
updateHasSVGTransformFlags() calls
enclosingLayer()->dirtyChildrenInDOMOrderForSVG()
when isTransformed() toggles. That method asserts m_svgData, so only an SVG
layer
may receive it. Add the same isSVGLayer() guard the insert/remove path already
uses
in RenderElement::dirtyEnclosingLayerSVGChildrenIfNeeded(), so an SVG renderer
whose
enclosing layer is not an SVG layer does not trip the assert or mutate the
wrong layer.
* Source/WebCore/rendering/RenderLayerModelObject.cpp:
(WebCore::RenderLayerModelObject::updateHasSVGTransformFlags):
Canonical link: https://commits.webkit.org/315592@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
