From 387f95187ee5201c8abc1f9d79ecbb0a36fad0e0 Mon Sep 17 00:00:00 2001
From: red person <redpersoncoding@gmail.com>
Date: Mon, 29 Jun 2026 11:16:26 -0700
Subject: [PATCH] Ignore invalid harmonize mask layers (#1829)

---
 static/js/editor/harmonize-masks.js           |  1 +
 .../test_harmonize_masks_invalid_layers_js.py | 32 +++++++++++++++++++
 2 files changed, 33 insertions(+)
 create mode 100644 tests/test_harmonize_masks_invalid_layers_js.py

diff --git a/static/js/editor/harmonize-masks.js b/static/js/editor/harmonize-masks.js
index c4a1206be..8a5a4f1ff 100644
--- a/static/js/editor/harmonize-masks.js
+++ b/static/js/editor/harmonize-masks.js
@@ -32,6 +32,7 @@
  * @returns {HTMLCanvasElement|null}
  */
 export function layerUnionAlpha(w, h, layers) {
+  if (!Array.isArray(layers)) return null;
   const visible = layers.filter(l => l.visible);
   if (visible.length < 2) return null;
   const bgId = visible[0].id;
diff --git a/tests/test_harmonize_masks_invalid_layers_js.py b/tests/test_harmonize_masks_invalid_layers_js.py
new file mode 100644
index 000000000..d776dde31
--- /dev/null
+++ b/tests/test_harmonize_masks_invalid_layers_js.py
@@ -0,0 +1,32 @@
+"""Pin harmonize mask helpers against invalid layer lists.
+
+Driven through `node --input-type=module`; skips without node.
+"""
+import json
+import shutil
+import subprocess
+from pathlib import Path
+
+import pytest
+
+_REPO = Path(__file__).resolve().parent.parent
+_HELPER = _REPO / "static" / "js" / "editor" / "harmonize-masks.js"
+_HAS_NODE = shutil.which("node") is not None
+
+
+@pytest.mark.skipif(not _HAS_NODE, reason="node binary not on PATH")
+def test_layer_union_alpha_returns_null_for_non_array_layers():
+    js = f"""
+    import {{ layerUnionAlpha, seamMask, layerBodyMask }} from '{_HELPER.as_posix()}';
+    console.log(JSON.stringify([
+      layerUnionAlpha(10, 10, null),
+      seamMask(10, 10, {{"bad": true}}),
+      layerBodyMask(10, 10, "bad")
+    ]));
+    """
+    proc = subprocess.run(
+        ["node", "--input-type=module"],
+        input=js, capture_output=True, text=True, cwd=str(_REPO), timeout=30,
+    )
+    assert proc.returncode == 0, proc.stderr
+    assert json.loads(proc.stdout.strip()) == [None, None, None]