Assertion failure: !newEditingHost->IsInNativeAnonymousSubtree(), at /home/worker/workspace/build/src/dom/base/Selection.cpp:3740
Categories
(Core :: DOM: Selection, defect, P3)
Tracking
()
People
(Reporter: jkratzer, Assigned: masayuki)
References
(Blocks 5 open bugs)
Details
(Keywords: assertion, pernosco, testcase)
Attachments
(8 files, 1 obsolete file)
808 bytes,
text/html
|
Details | |
991 bytes,
text/html
|
Details | |
844 bytes,
text/html
|
Details | |
389 bytes,
text/html
|
Details | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review |
Testcase found while fuzzing mozilla-central rev 20170726-e8400551c2e3. Assertion failure: !newEditingHost->IsInNativeAnonymousSubtree(), at /home/worker/workspace/build/src/dom/base/Selection.cpp:3740 ASAN:DEADLYSIGNAL ================================================================= ==29714==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f71f79f9c4b bp 0x7fffab425bd0 sp 0x7fffab425920 T0) ==29714==The signal is caused by a WRITE memory access. ==29714==Hint: address points to the zero page. #0 0x7f71f79f9c4a in mozilla::dom::Selection::NotifySelectionListeners() /home/worker/workspace/build/src/dom/base/Selection.cpp:3742:45 #1 0x7f71fb226227 in nsFrameSelection::NotifySelectionListeners(mozilla::SelectionType) /home/worker/workspace/build/src/layout/generic/nsFrameSelection.cpp:2067:23 #2 0x7f71f79f4211 in mozilla::dom::Selection::Collapse(nsINode&, unsigned int, mozilla::ErrorResult&) /home/worker/workspace/build/src/dom/base/Selection.cpp:2581:28 #3 0x7f71f79f4be5 in mozilla::dom::Selection::CollapseToEnd(mozilla::ErrorResult&) /home/worker/workspace/build/src/dom/base/Selection.cpp:2682:3 #4 0x7f71f79f4d5d in mozilla::dom::Selection::CollapseToEndJS(mozilla::ErrorResult&) /home/worker/workspace/build/src/dom/base/Selection.cpp:2653:3 #5 0x7f71f85c86d6 in mozilla::dom::SelectionBinding::collapseToEnd(JSContext*, JS::Handle<JSObject*>, mozilla::dom::Selection*, JSJitMethodCallArgs const&) /home/worker/workspace/build/src/obj-firefox/dom/bindings/SelectionBinding.cpp:549:9 #6 0x7f71f928134e in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) /home/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3060:13 #7 0x7f71fe1ae6b1 in js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) /home/worker/workspace/build/src/js/src/jscntxtinlines.h:293:15 #8 0x7f71fe1ae25d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:469:16 #9 0x7f71fe1af0f5 in InternalCall(JSContext*, js::AnyInvokeArgs const&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:514:12 #10 0x7f71fe1a3b55 in Interpret(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3064:18 #11 0x7f71fe18f7b1 in js::RunScript(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:409:12 #12 0x7f71fe1b0d32 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:698:15 #13 0x7f71fe1b18c2 in js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:730:12 #14 0x7f71fea1a64f in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::Value*) /home/worker/workspace/build/src/js/src/jsapi.cpp:4637:12 #15 0x7f71fea1aeb6 in ExecuteScript(JSContext*, JS::AutoObjectVector&, JS::Handle<JSScript*>, JS::Value*) /home/worker/workspace/build/src/js/src/jsapi.cpp:4656:12 #16 0x7f71fea1aa9e in JS_ExecuteScript(JSContext*, JS::AutoObjectVector&, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/jsapi.cpp:4677:12 #17 0x7f71f7bc706b in nsJSUtils::ExecutionContext::CompileAndExec(JS::CompileOptions&, JS::SourceBufferHolder&, JS::MutableHandle<JSScript*>) /home/worker/workspace/build/src/dom/base/nsJSUtils.cpp:265:8 #18 0x7f71fa97233f in mozilla::dom::ScriptLoader::EvaluateScript(mozilla::dom::ScriptLoadRequest*) /home/worker/workspace/build/src/dom/script/ScriptLoader.cpp:2191:25 #19 0x7f71fa96f1f0 in mozilla::dom::ScriptLoader::ProcessRequest(mozilla::dom::ScriptLoadRequest*) /home/worker/workspace/build/src/dom/script/ScriptLoader.cpp:1775:10 #20 0x7f71fa95d5e1 in mozilla::dom::ScriptLoader::ProcessScriptElement(nsIScriptElement*) /home/worker/workspace/build/src/dom/script/ScriptLoader.cpp:1471:10
Updated•7 years ago
|
Updated•7 years ago
|
Comment 1•7 years ago
|
||
INFO: Last good revision: e36088242facca249d718e6d79a6cfa7007fd42b INFO: First bad revision: f5da859b433fe40803847ad77cc4a573fbf8dc25 INFO: Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=e36088242facca249d718e6d79a6cfa7007fd42b&tochange=f5da859b433fe40803847ad77cc4a573fbf8dc25 Regressed by bug 1365092.
Comment 2•7 years ago
|
||
Kirk, can you take a look? If you want me to do it, please let me know!
Updated•7 years ago
|
Comment 3•7 years ago
|
||
I believe I have tracked down the source of the problem. Previous behavior: |nsGenericHTMLElement::SetContentEditable| indirectly invokes the (virtual) function |nsGenericHTMLElement::SetAttr|. |nsGenericHTMLElement::SetAttr| invokes |Element::SetAttr|. |Element::SetAttr| creates a |mozAutoDocUpdate| object on the stack. |Element::SetAttr| returns, destroying the |mozAutoDocUpdate| object. |nsGenericHTMLElement::SetAttr| continues execution, calling |ChangeEditableState(1);|. This results in |nsHTMLDocument::mContentEditableCount| being changed from 0 to 1. New behavior: |nsGenericHTMLElement::SetContentEditable| indirectly invokes the function |Element::SetAttr| |Element::SetAttr| creates a |mozAutoDocUpdate| object on the stack. |Element::SetAttr| calls |Element::SetAttrAndNotify|, which calls the (virtual) function |nsGenericHTMLElement::AfterSetAttr|. |nsGenericHTMLElement::AfterSetAttr| calls |ChangeEditableState(1);|. This results in |nsHTMLDocument::mContentEditableCount| being changed from 0 to 1. |Element::SetAttr| returns, destroying the |mozAutoDocUpdate| object. |mozAutoDocUpdate::~mozAutoDocUpdate| indirectly calls |nsHTMLDocument::MaybeEditingStateChanged|. This function has no effect unless |(mContentEditableCount > 0) != IsEditingOn()| [1]. Because the new behavior changes |mContentEditableCount| before |mozAutoDocUpdate::~mozAutoDocUpdate| is called (rather than after), this function now has a completely different effect. It now results in |Selection::AddItem| being called. When examining the previous behavior, I see that |Selection::CollapseToEnd| returns early (here [2]). But with the new behavior, it does not return there, ultimately resulting in the assertion failure described. I am still looking into what the correct solution to this problem might be, but I wanted to post an update on my progress. [1] http://searchfox.org/mozilla-central/rev/dca019c94bf3a840ed7ff50261483410cfece24f/dom/html/nsHTMLDocument.cpp#2490 [2] http://searchfox.org/mozilla-central/rev/dca019c94bf3a840ed7ff50261483410cfece24f/dom/base/Selection.cpp#2763
Comment 4•7 years ago
|
||
This testcase hits the assert on revision e36088242fac, which is before Kirk's patches. On the original testcase in this bug, before Kirk's patch, we do ~mozAutoDocUpdate before ChangeEditableState(1) happens, so it doesn't turn on editing mode. Then we land in nsHTMLDocument::ChangeContentEditableCount, which effectively sync-calls DeferredContentEditableCountChangeEvent::Run, which calls nsHTMLDocument::DeferredContentEditableCountChange. That bails out early because mParser is false, so we don't turn on editing mode. Then the selection bits don't see an editable area there, and don't end up in whatever weird state triggers the assert. In the modified testcase, I simply trigger _another_ ~mozAutoDocUpdate after all of that stuff. This time the ~mozAutoDocUpdate sees a nonzero mContentEditableCount, does EditingStateChanged(), etc. All that Kirk's patch did was make the _first_ ~mozAutoDocUpdate trigger EditingStateChanged(); it's not the real culprit here. Kirk and I looked at this for a bit, and we don't really understand the state handling in this code. DeferredContentEditableCountChange checks mParser (and relies on EndLoad to turn on editing state), but none of the other callers of EditingStateChanged check mParser. What are the invariants we're trying to maintain here, exactly? Peter, I think you have blame for all this stuff, and Ehsan is out so you're our best bet here....
Comment 5•7 years ago
|
||
This is just like trigger.html, but all the code runs onload instead of during parsing, so mParser is null in DeferredContentEditableCountChange and we go ahead and update editing state right when the contenteditable attr is set. Fundamentally, I expect we're ending up with the selection inside the <input> but it's asserting it's in a contenteditable area or so...
Comment 6•7 years ago
|
||
Er, forgot to save after uncommenting...
Comment 7•7 years ago
|
||
(In reply to Boris Zbarsky [:bz] (no decent commit message means r-) from comment #4) > Kirk and I looked at this for a bit, and we don't really understand the > state handling in this code. DeferredContentEditableCountChange checks > mParser (and relies on EndLoad to turn on editing state), but none of the > other callers of EditingStateChanged check mParser. What are the invariants > we're trying to maintain here, exactly? Peter, I think you have blame for > all this stuff, and Ehsan is out so you're our best bet here.... Note that it's been 10 years since I last worked on this, and there's been quite a bit of changes to this code since then that I don't understand yet either. IIRC there were two main callers to EditingStateChanged, for contentEditable and for designMode. For contentEditable we delayed turning on editing during page load, IIRC because of concerns for performance. That's the check for mParser that's in EndLoad and used to be in ChangeContentEditableCount (looks like that's now in DeferredContentEditableCountChange). We should probably have added it to the code in EndUpdate (now in MaybeEditingStateChanged) for bug 395340. The other callers were for designMode, when the property was set and document.open on a document that was already in designMode. Those just didn't have the mParser checks, because it seemed unnecessary. I don't know about other callers that were added later (BeginLoad?). I'm fine with trying to remove the mParser check if that helps, it'll just turn on editing on the first contentEditable element that's added during pageload. I think the main change will be that we'll be running more spellchecking code in pages with multiple contentEditable elments, but that might be fine.
Comment 8•7 years ago
|
||
Maybe Masayuki, Makoto, or Henri know something here (I'm just guessing; feel free to just clear the needinfo and tell me I owe you a beverage some time ;)?
Comment 9•7 years ago
|
||
As mentioned above, the patch that I wrote did not cause the underlying problem here. I do not really have any knowledge specific to the area that needs to be fixed here. I am therefore unassigning myself from this bug. If I can be of any further help though, feel free to needinfo me.
Comment 10•7 years ago
|
||
OK. So my second testcase shows that all this stuff about mParser and when editing gets turned on is a red herring, apart from the code being super-confusing and complicated. I filed bug 1410504 on that part. The real issue here is that we end up in a state where part of the document is editable, we do a caret move, the caret ends up in the <input>, I would guess, and then selection asserts we're not in anon content, but of course we are. So this is basically a question about what our caret behavior should be in this situation...
Comment 11•7 years ago
|
||
(In reply to Andrew Overholt [:overholt] from comment #8) > Maybe Masayuki, Makoto, or Henri know something here (I'm just guessing; This is outside my area of expertise.
Assignee | ||
Comment 12•7 years ago
|
||
I still don't understand this bug. We should hit the assertion only when contenteditable element is in anonymous subtree. If the assertion's condition is wrong (not enough), let me know.
Comment 13•7 years ago
|
||
> We should hit the assertion only when contenteditable element is in anonymous subtree.
We're hitting the assertion when newEditingHost is the anonymous <div> inside an <input>. It's definitely in an anonymous subtree, and it is very much _NOT_ contenteditable in the sense of the HTML attribute.
It does have NODE_IS_EDITABLE, because it's the editing host for the input's editor.
Now another node in the document _is_ contenteditable, which is why Selection::NotifySelectionListener is entering the relevant block at all (document is not editable as a whole, but there is an HTML editor, for the contenteditable node that's there). And Selection::GetCommonEditingHostForAllRanges just returns the <div> there, because the selection is inside the <input>.
focusedElement is null in this case, by the way.
Comment 14•6 years ago
|
||
https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Move_fix-optionals
Comment 15•6 years ago
|
||
Ah, GetCommonEditingHostForAllRanges is only called with contenteditable, but it shouldn't return anonymous node. I make sense it.
Updated•2 years ago
|
Assignee | ||
Comment 17•1 year ago
|
||
I don't reproduce the assertion failure in debug build. Did we fix that Selection::Modify
result may cross native anonymous subtree boundaries?
Assignee | ||
Comment 18•1 year ago
|
||
On the other hand, I think that we should guarantee that nsIContent::GetEditingHost()
won't return <foo contenteditable>
when the content is in a native anonymous subtree because currently, we don't have such feature and returning editing host with crossing native anonymous subtree boundary is not necessary (and I think it's odd).
Comment 19•1 year ago
|
||
Another more recent test case.
Comment 20•1 year ago
|
||
Masayuki would a Pernosco session be helpful?
Assignee | ||
Comment 21•1 year ago
|
||
Yeah, if there is, please. Otherwise, I'll try to debug with the debugger.
Thank you for the reproducible testcase.
Comment 22•1 year ago
|
||
A Pernosco session is available here: https://pernos.co/debug/D-Y9tq8T_guvcicls3S3ig/index.html
Assignee | ||
Comment 24•1 year ago
|
||
It's called by PeekOffsetFor*
and GetPrevNextBidiLevels
, so it's used for
considering whether to put caret or move a selection range boundary.
Therefore, it should treat nodes which can be managed by Selection
as
selectable. In theory, even if a native anonymous subtree does not have
an independent selection, its content nodes should not be the container of
the selection range boundaries of selection outside the subtree since
Selection API shouldn't expose nodes in native anonymous subtrees. Therefore,
it can simply treat content nodes in different anonymous subtrees are not
selectable.
Note that it's not standardized that how Selection.modify
works with various
content nodes.
https://w3c.github.io/selection-api/#dom-selection-modify
And also Chrome cannot cross generated content like form controls with this API.
This could cause web-compat issues, but it does not make sense for caret
navigation, and anyway out of scope of this bug. Therefore, this patch just
adds the crash test.
Assignee | ||
Comment 25•1 year ago
|
||
Comment 26•1 year ago
|
||
Pushed by masayuki@d-toybox.com: https://hg.mozilla.org/integration/autoland/rev/b3c0fd32af16 Make `nsIFrame::GetFrameFromDirection` treat frames in different native anonymous subtree not selectable r=emilio https://hg.mozilla.org/integration/autoland/rev/bfc8cf25efac Add automated tests for caret browsing around form controls r=emilio
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/38973 for changes under testing/web-platform/tests
Comment 28•1 year ago
|
||
Backed out for causing failures on test_atcaretoffset.html
Upstream PR was closed without merging
Assignee | ||
Comment 30•1 year ago
•
|
||
Really really odd... Indeed, test_atcaretoffset.html
fails in my environment too. However, even if I add MOZ_CRASH
in the added path, the test runs. I.e., it does not run into the new path.
On the other hand, test_wordboundary.html
passes completely in my environment... So, I have no idea why they fail in CI.
Assignee | ||
Comment 31•1 year ago
|
||
Odd, it fails only in the mode of "a11y-no-cache-1proc". Sounds like that its created a11y tree and the others' ones are different.
Assignee | ||
Comment 32•1 year ago
|
||
When it fails, I verified that the new path runs within this call stack in a child process:
#01: NS_DebugBreak (xpcom\base\nsDebugImpl.cpp:492)
#02: nsIFrame::GetFrameFromDirection (layout\generic\nsIFrame.cpp:9611)
#03: nsIFrame::PeekOffsetForWord (layout\generic\nsIFrame.cpp:9046)
#04: nsIFrame::PeekOffset (layout\generic\nsIFrame.cpp:9336)
#05: mozilla::a11y::HyperTextAccessible::FindOffset (accessible\generic\HyperTextAccessible.cpp:546)
#06: mozilla::a11y::HyperTextAccessible::TextBeforeOffset (accessible\generic\HyperTextAccessible.cpp:988)
#07: mozilla::a11y::xpcAccessibleHyperText::GetTextBeforeOffset (accessible\xpcom\xpcAccessibleHyperText.cpp:82)
Assignee | ||
Comment 33•1 year ago
|
||
The scan start frame is considered in HyperTextAccessible::FindOffset
, however, with the patch, childFrame->GetChildFrameContainingOffset
in the frame won't return text frame in <textarea>
anymore.
According to the other conditions' result of a11y tests, a11y module wants to traverse frames across native anonymous subtree boundaries.
James: Is it what a11y module wants? Or just aligned for the behavior of nsIFrame::PeekOffset
? For the other users of nsIFrame::PeekOffset
, it won't cross the native anonymous subtree boundaries from parent to child. Therefore, I try to do it. However, a11y module keeps wanting to cross the boundaries, I'll create an option for it.
Comment 34•1 year ago
|
||
First, the reason this only fails in the no-cache test variant is that the new a11y caching architecture has a completely different text implementation that doesn't rely on PeekOffset and is more aligned with what a11y needs. The timing here is tricky. On one hand, we aim to ship this new architecture very soon. It's unfortunately too risky to just ship it immediately, but we're about to launch a release experiment and we'll hopefully ship to all users on release a few weeks after that if all goes well. On the other hand, waiting for that would delay your patch by several weeks at minimum.
Second, what a11y wants here is to navigate from a given offset in a text node to get the next/previous word, line, etc. I'm not quite clear on what childFrame is in childFrame->GetChildFrameContainingOffset
in the textarea case. Is childFrame not the primary text frame? We could probably just tweak the a11y code to start with the right frame in this special case.
Assignee | ||
Comment 35•1 year ago
|
||
(In reply to James Teh [:Jamie] from comment #34)
Second, what a11y wants here is to navigate from a given offset in a text node to get the next/previous word, line, etc. I'm not quite clear on what childFrame is in
childFrame->GetChildFrameContainingOffset
in the textarea case. Is childFrame not the primary text frame? We could probably just tweak the a11y code to start with the right frame in this special case.
Yeah, the failure means that the childFrame
is a frame outside the TextControlFrame
of <textarea>
or the TextControlFrame
itself. I'll check which frame is the childFrame
after lunch.
Assignee | ||
Comment 36•1 year ago
|
||
Hmm, odd.
0:16.05 PASS getTextBeforeOffset (word start): wrong end offset(got '0', expected: '0'), offset: -2, id: 'textarea' ;
0:16.07 GECKO(6496) childFrame: 0000027828813940 (000002782880FA80, #text.div.textarea['textarea'].pre['test'].body.html.#document)
0:16.07 GECKO(6496) frameAtOffset: 0000027828813940 (000002782880FA80 #text.div.textarea['textarea'].pre['test'].body.html.#document)
0:16.07 GECKO(6496) aFrame: 0000000000000000 (000002782880F200 #text.pre['test'].body.html.#document)
0:16.07 GECKO(6496) this: 0000027828813940 (000002782880FA80 #text.div.textarea['textarea'].pre['test'].body.html.#document)
0:16.07 GECKO(6496) aFrame: 0000000000000000 (000002782880F200 #text.pre['test'].body.html.#document)
0:16.07 GECKO(6496) this: 0000027828813940 (000002782880FA80 #text.div.textarea['textarea'].pre['test'].body.html.#document)
0:16.07 GECKO(6496) aFrame: 0000000000000000 (0000027828813EE0 p['display'].body.html.#document)
0:16.07 GECKO(6496) this: 0000027828813940 (000002782880FA80 #text.div.textarea['textarea'].pre['test'].body.html.#document)
0:16.07 GECKO(6496) aFrame: 0000000000000000 (000002782880FE80 #text.a.body.html.#document)
0:16.07 GECKO(6496) this: 0000027828813940 (000002782880FA80 #text.div.textarea['textarea'].pre['test'].body.html.#document)
0:16.07 GECKO(6496) childFrame: 0000027828813940 (000002782880FA80, #text.div.textarea['textarea'].pre['test'].body.html.#document)
0:16.07 GECKO(6496) frameAtOffset: 0000027828813940 (000002782880FA80 #text.div.textarea['textarea'].pre['test'].body.html.#document)
0:16.06 FAIL getTextBeforeOffset (word end): wrong text (got '
', expected: ''), offset: -2, id: 'textarea' ;
The first address is the anonymous subtree root of the content of the frame. Next address is the content of the frame. And the last path is the content of the frame's path. aFrame
and this
are in the IsSelectable
at here. So it fails to scan a word in <textarea>
starting from the previous text node in <a>
.
If I back it out my change, I don't see the scan starting from #text.a.body.html.#document
. Therefore, my change changes the previous result of the failing test... It seems that the simplest fix is, making nsPeekOffsetStruct
take new option to keep traversing frames in native anonymous subtrees.
Comment 37•1 year ago
•
|
||
:( That is unfortunate given how close a11y is to not needing PeekOffset at all. I guess it's not so hard to remove that option later though.
Comment 38•1 year ago
|
||
I put a note in bug 1821951 comment 1 to remove this PeekOffset flag once a11y doesn't need it.
Assignee | ||
Comment 39•1 year ago
|
||
Yeah, and I don't like a lot of bool
s in nsPeekOffsetStruct
and in the handlers. Therefore, I'll rewrite them with an EnumSet
. Then, only the endpoints will need to be removed.
Updated•1 year ago
|
Updated•1 year ago
|
Assignee | ||
Comment 40•1 year ago
|
||
The constructor of nsPeekOffsetStruct
and nsIFrame::GetFrameFromDirection
take too many bool
arguments. Therefore, adding new bool
arguments does
not make sense. Now, we have a useful mozilla:EnumSet
class to treat them
with an enum class
. Therefore, let's change nsPeekOffsetStruct
with it.
Depends on D172347
Assignee | ||
Comment 41•1 year ago
|
||
The a11y module wants to traverse frames in native anonymous subtrees.
Therefore, this patch adds new option for allowing it, makes
nsIFrame::GetFrameFromDirection
check it before comparing native anonymous
subtree root nodes, and makes HyperTextAccessible::FindOffset
use the
option.
Depends on D172758
Comment 42•1 year ago
|
||
Pushed by masayuki@d-toybox.com: https://hg.mozilla.org/integration/autoland/rev/f3a38b1eac88 part 1: Make `nsIFrame::GetFrameFromDirection` treat frames in different native anonymous subtree not selectable r=emilio https://hg.mozilla.org/integration/autoland/rev/22099c5efaf6 part 2: Add automated tests for caret browsing around form controls r=emilio https://hg.mozilla.org/integration/autoland/rev/0782f42b2a99 part 3: Make `nsPeekOffsetStruct` and its handlers treat `bool` options with an `EnumSet` r=emilio https://hg.mozilla.org/integration/autoland/rev/917f487fdf0f part 4: Make `nsIFrame::GetFrameFromDirection` allow to return content in different native anonymous subtree if the caller wants r=emilio
Comment 43•1 year ago
|
||
Backed out 4 changesets (Bug 1384606) for causing build bustage in nsFrameSelection.h CLOSED TREE
Log: https://treeherder.mozilla.org/logviewer?job_id=409240439&repo=autoland&lineNumber=7018
Backout: https://hg.mozilla.org/integration/autoland/rev/7a93650998b38d6a5797322b868da6153407d268
Assignee | ||
Comment 44•1 year ago
|
||
Oh, sorry. I didn't update part.4 for the latest part.3.
Upstream PR was closed without merging
Comment 46•1 year ago
|
||
Pushed by masayuki@d-toybox.com: https://hg.mozilla.org/integration/autoland/rev/39b202962261 part 1: Make `nsIFrame::GetFrameFromDirection` treat frames in different native anonymous subtree not selectable r=emilio https://hg.mozilla.org/integration/autoland/rev/eb8a5705b2d3 part 2: Add automated tests for caret browsing around form controls r=emilio https://hg.mozilla.org/integration/autoland/rev/19c51e735059 part 3: Make `nsPeekOffsetStruct` and its handlers treat `bool` options with an `EnumSet` r=emilio https://hg.mozilla.org/integration/autoland/rev/6f7176c0d6a3 part 4: Make `nsIFrame::GetFrameFromDirection` allow to return content in different native anonymous subtree if the caller wants r=emilio
Comment 47•1 year ago
|
||
Backed out for causing mochitest browser a11y failures on browser_text_basics.js.
[task 2023-03-17T07:43:47.528Z] 07:43:47 INFO - TEST-PASS | accessible/tests/browser/mac/browser_text_basics.js | attributed text matches non-attributed text -
[task 2023-03-17T07:43:47.528Z] 07:43:47 INFO - Buffered messages finished
[task 2023-03-17T07:43:47.529Z] 07:43:47 INFO - TEST-UNEXPECTED-FAIL | accessible/tests/browser/mac/browser_text_basics.js | At index 282: right word matches - Got " deceived you, ", expected " "
[task 2023-03-17T07:43:47.530Z] 07:43:47 INFO - Stack trace:
[task 2023-03-17T07:43:47.530Z] 07:43:47 INFO - chrome://mochikit/content/browser-test.js:test_is:1512
[task 2023-03-17T07:43:47.530Z] 07:43:47 INFO - chrome://mochitests/content/browser/accessible/tests/browser/mac/browser_text_basics.js:testRangeAtMarker:9
[task 2023-03-17T07:43:47.530Z] 07:43:47 INFO - chrome://mochitests/content/browser/accessible/tests/browser/mac/browser_text_basics.js:testWords:70
[task 2023-03-17T07:43:47.530Z] 07:43:47 INFO - chrome://mochitests/content/browser/accessible/tests/browser/mac/browser_text_basics.js:testMarkerIntegrity:168
[task 2023-03-17T07:43:47.530Z] 07:43:47 INFO - chrome://mochitests/content/browser/accessible/tests/browser/mac/browser_text_basics.js:null:272
[task 2023-03-17T07:43:47.530Z] 07:43:47 INFO - chrome://mochitests/content/browser/accessible/tests/browser/shared-head.js:accessibleTask/</<:557
[task 2023-03-17T07:43:47.530Z] 07:43:47 INFO - resource://testing-common/BrowserTestUtils.sys.mjs:withNewTab:154
[task 2023-03-17T07:43:47.530Z] 07:43:47 INFO - chrome://mochitests/content/browser/accessible/tests/browser/shared-head.js:accessibleTask/<:476
[task 2023-03-17T07:43:47.530Z] 07:43:47 INFO - chrome://mochikit/content/browser-test.js:handleTask:1039
[task 2023-03-17T07:43:47.530Z] 07:43:47 INFO - chrome://mochikit/content/browser-test.js:_runTaskBasedTest:1111
[task 2023-03-17T07:43:47.530Z] 07:43:47 INFO - chrome://mochikit/content/browser-test.js:Tester_execTest:1253
[task 2023-03-17T07:43:47.530Z] 07:43:47 INFO - chrome://mochikit/content/browser-test.js:nextTest/<:1028
[task 2023-03-17T07:43:47.530Z] 07:43:47 INFO - chrome://mochikit/content/tests/SimpleTest/SimpleTest.js:SimpleTest.waitForFocus/<:1053
[task 2023-03-17T07:43:47.530Z] 07:43:47 INFO - TEST-PASS | accessible/tests/browser/mac/browser_text_basics.js | attributed text matches non-attributed text -
Upstream PR was closed without merging
Assignee | ||
Comment 49•1 year ago
•
|
||
Hmm. The known intemittent failue hid it from my eyes sorry.
Assignee | ||
Comment 50•1 year ago
|
||
Ah, HyperTextAccessibleWrap.mm
is the implementation of what I changed in part.4...
Comment 51•1 year ago
|
||
Pushed by masayuki@d-toybox.com: https://hg.mozilla.org/integration/autoland/rev/1da78b470683 part 1: Make `nsIFrame::GetFrameFromDirection` treat frames in different native anonymous subtree not selectable r=emilio https://hg.mozilla.org/integration/autoland/rev/4e426b984cbc part 2: Add automated tests for caret browsing around form controls r=emilio https://hg.mozilla.org/integration/autoland/rev/38940e315386 part 3: Make `nsPeekOffsetStruct` and its handlers treat `bool` options with an `EnumSet` r=emilio https://hg.mozilla.org/integration/autoland/rev/9bf85e2170e0 part 4: Make `nsIFrame::GetFrameFromDirection` allow to return content in different native anonymous subtree if the caller wants r=emilio
Comment 52•1 year ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/1da78b470683
https://hg.mozilla.org/mozilla-central/rev/4e426b984cbc
https://hg.mozilla.org/mozilla-central/rev/38940e315386
https://hg.mozilla.org/mozilla-central/rev/9bf85e2170e0
Upstream PR merged by moz-wptsync-bot
Updated•1 year ago
|
Description
•