1393818 - Assertion failure: mAction == EditAction::none (Initializing during an edit action is an error)

Status: NEW

(Core :: DOM: Editor, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: trigger.html

Testcase found while fuzzing mozilla-central rev 20170825-2306e153fba9.

Assertion failure: mAction == EditAction::none (Initializing during an edit action is an error), at /home/worker/workspace/build/src/editor/libeditor/EditorBase.cpp:225
#01: mozilla::TextEditor::Init at editor/libeditor/TextEditor.cpp:136
#02: mozilla::HTMLEditor::Init at editor/libeditor/HTMLEditor.cpp:270
#03: nsEditingSession::SetupEditorOnWindow at editor/composer/nsEditingSession.cpp:463
#04: nsEditingSession::MakeWindowEditable at editor/composer/nsEditingSession.cpp:183
#05: nsHTMLDocument::EditingStateChanged at dom/html/nsHTMLDocument.cpp:2861
#06: nsHTMLDocument::SetDesignMode at dom/html/nsHTMLDocument.cpp:2978
#07: nsHTMLDocument::SetDesignMode at mfbt/Maybe.h:445
#08: mozilla::dom::HTMLDocumentBinding::set_designMode at s3:gecko-generated-sources:64b09d1bcd2abe9ccee4a25413be74081dd54eb49ecea5100966e450ab9d7d1ef8391021a6e9a66be64575c60373e5933a077967ab52ca896c5c75ce22defdd5/dom/bindings/HTMLDocumentBinding.cpp::807
#09: mozilla::dom::GenericBindingSetter at dom/bindings/BindingUtils.cpp:3014
#10: js::CallJSNative at js/src/jscntxtinlines.h:294
#11: js::InternalCallOrConstruct at js/src/vm/Interpreter.cpp:469
#12: js::Call at js/src/vm/Interpreter.cpp:533
#13: js::CallSetter at js/src/vm/Interpreter.cpp:661
#14: js::NativeSetProperty at js/src/vm/NativeObject.cpp:2764
#15: js::SetPropertyIgnoringNamedGetter at js/src/vm/NativeObject.h:1553

Comment 1

[Makoto Kato [:m_kato]]

assertion only

Comment 2

[Ryan VanderMeulen [:RyanVM]]

Reproduces further back than mozregression can bisect debug builds.

Comment 3

[Firefox Bug Husbandry Bot]

https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Move_fix-optionals