Open Bug 1393818 Opened 3 years ago Updated 2 years ago

Assertion failure: mAction == EditAction::none (Initializing during an edit action is an error)

Categories

(Core :: DOM: Editor, defect, P3)

defect

Tracking

()

Tracking Status
firefox-esr52 --- wontfix
firefox55 --- wontfix
firefox56 --- wontfix
firefox57 --- wontfix
firefox58 --- wontfix
firefox59 --- ?

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

Attached file trigger.html
Testcase found while fuzzing mozilla-central rev 20170825-2306e153fba9.

Assertion failure: mAction == EditAction::none (Initializing during an edit action is an error), at /home/worker/workspace/build/src/editor/libeditor/EditorBase.cpp:225
#01: mozilla::TextEditor::Init at editor/libeditor/TextEditor.cpp:136
#02: mozilla::HTMLEditor::Init at editor/libeditor/HTMLEditor.cpp:270
#03: nsEditingSession::SetupEditorOnWindow at editor/composer/nsEditingSession.cpp:463
#04: nsEditingSession::MakeWindowEditable at editor/composer/nsEditingSession.cpp:183
#05: nsHTMLDocument::EditingStateChanged at dom/html/nsHTMLDocument.cpp:2861
#06: nsHTMLDocument::SetDesignMode at dom/html/nsHTMLDocument.cpp:2978
#07: nsHTMLDocument::SetDesignMode at mfbt/Maybe.h:445
#08: mozilla::dom::HTMLDocumentBinding::set_designMode at s3:gecko-generated-sources:64b09d1bcd2abe9ccee4a25413be74081dd54eb49ecea5100966e450ab9d7d1ef8391021a6e9a66be64575c60373e5933a077967ab52ca896c5c75ce22defdd5/dom/bindings/HTMLDocumentBinding.cpp::807
#09: mozilla::dom::GenericBindingSetter at dom/bindings/BindingUtils.cpp:3014
#10: js::CallJSNative at js/src/jscntxtinlines.h:294
#11: js::InternalCallOrConstruct at js/src/vm/Interpreter.cpp:469
#12: js::Call at js/src/vm/Interpreter.cpp:533
#13: js::CallSetter at js/src/vm/Interpreter.cpp:661
#14: js::NativeSetProperty at js/src/vm/NativeObject.cpp:2764
#15: js::SetPropertyIgnoringNamedGetter at js/src/vm/NativeObject.h:1553
Flags: in-testsuite?
assertion only
Priority: -- → P3
Reproduces further back than mozregression can bisect debug builds.
Has Regression Range: --- → no
See Also: → 847136
You need to log in before you can comment on or make changes to this bug.