968204 - Faulty: ABORT: "Incompatibe surface type" in CanvasLayerComposite::Initialize under LayerTransactionParent::RecvUpdate, TColorLayerAttributes case

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Benoit Jacob [:bjacob] (mostly away)]

Attachment: Faulty session

Found by Christoph Diehl's "Faulty" fuzzer, see bug 777067

This seems like we're trying to reinterpret a CanvasLayer as... a ColorLayer?

Indeed we have:

  enum LayerType {
    TYPE_CANVAS,
    TYPE_COLOR,
    TYPE_CONTAINER,
    TYPE_IMAGE,
    TYPE_READBACK,
    TYPE_REF,
    TYPE_SHADOW,
    TYPE_THEBES
  };

So for Faulty to cause a CanvasLayer to be reinterpreted as a ColorLayer, all it would have to do would be to change a 0 into a 1, which it did a few times in time session.

Comment 1

[Benoit Jacob [:bjacob] (mostly away)]

Classification: PLayerTransaction, wrong layer type, hard

Comment 2

[Benoit Jacob [:bjacob] (mostly away)]

Fixed by the landing of PLayerTransaction type checks before casting layers, bug 968833.