Closed
Bug 968204
Opened 10 years ago
Closed 10 years ago
Faulty: ABORT: "Incompatibe surface type" in CanvasLayerComposite::Initialize under LayerTransactionParent::RecvUpdate, TColorLayerAttributes case
Categories
(Core :: Graphics, defect)
Tracking
()
RESOLVED
FIXED
mozilla30
People
(Reporter: bjacob, Assigned: bjacob)
References
(Blocks 1 open bug)
Details
Attachments
(1 file)
37.15 KB,
text/plain
|
Details |
Found by Christoph Diehl's "Faulty" fuzzer, see bug 777067 This seems like we're trying to reinterpret a CanvasLayer as... a ColorLayer? Indeed we have: enum LayerType { TYPE_CANVAS, TYPE_COLOR, TYPE_CONTAINER, TYPE_IMAGE, TYPE_READBACK, TYPE_REF, TYPE_SHADOW, TYPE_THEBES }; So for Faulty to cause a CanvasLayer to be reinterpreted as a ColorLayer, all it would have to do would be to change a 0 into a 1, which it did a few times in time session.
Assignee | ||
Comment 1•10 years ago
|
||
Classification: PLayerTransaction, wrong layer type, hard
Assignee | ||
Updated•10 years ago
|
Depends on: PReinterpretCast
Assignee | ||
Comment 2•10 years ago
|
||
Fixed by the landing of PLayerTransaction type checks before casting layers, bug 968833.
Assignee: nobody → bjacob
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Updated•10 years ago
|
Target Milestone: --- → mozilla30
You need to log in
before you can comment on or make changes to this bug.
Description
•