1393863 - Assertion failure: index != -1

Status: RESOLVED WORKSFORME

(Core :: DOM: Editor, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: trigger.html

Testcase found while fuzzing mozilla-central rev 20170825-2306e153fba9.

Assertion failure: index != -1, at /home/worker/workspace/build/src/editor/libeditor/EditorBase.cpp:3210
#01: mozilla::EditorBase::GetNodeLocation at editor/libeditor/EditorBase.cpp:3242
#02: mozilla::HTMLEditRules::ReturnInParagraph at editor/libeditor/HTMLEditRules.cpp:6479
#03: mozilla::HTMLEditRules::WillInsertBreak at editor/libeditor/HTMLEditRules.cpp:1631
#04: mozilla::HTMLEditRules::WillDoAction at editor/libeditor/HTMLEditRules.cpp:650
#05: mozilla::TextEditor::InsertLineBreak at editor/libeditor/TextEditor.cpp:702
#06: mozilla::TextEditor::TypedText at editor/libeditor/TextEditor.cpp:410
#07: mozilla::HTMLEditor::TypedText at editor/libeditor/HTMLEditor.cpp:1027
#08: mozilla::InsertParagraphCommand::DoCommand at editor/libeditor/EditorCommands.cpp:1154
#09: nsControllerCommandTable::DoCommand at dom/commandhandler/nsControllerCommandTable.cpp:139
#10: nsBaseCommandController::DoCommand at xpcom/base/nsCOMPtr.h:801
#11: nsCommandManager::DoCommand at dom/commandhandler/nsCommandManager.cpp:212
#12: nsHTMLDocument::ExecCommand at dom/bindings/ErrorResult.h:376
#13: mozilla::dom::HTMLDocumentBinding::execCommand at s3:gecko-generated-sources:64b09d1bcd2abe9ccee4a25413be74081dd54eb49ecea5100966e450ab9d7d1ef8391021a6e9a66be64575c60373e5933a077967ab52ca896c5c75ce22defdd5/dom/bindings/HTMLDocumentBinding.cpp::892
#14: mozilla::dom::GenericBindingMethod at dom/bindings/BindingUtils.cpp:3055
#15: js::CallJSNative at js/src/jscntxtinlines.h:294

Comment 1

[Makoto Kato [:m_kato]]

assertion only

Comment 2

[Ryan VanderMeulen [:RyanVM]]

INFO: Last good revision: 1986a6f181d7c97e9e90ea645ebc7397f1b2b322
INFO: First bad revision: 7d39d921ab4241c3dc9dd9013ee5d3c950c084fa
INFO: Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=1986a6f181d7c97e9e90ea645ebc7397f1b2b322&tochange=7d39d921ab4241c3dc9dd9013ee5d3c950c084fa

Comment 3

[Firefox Bug Husbandry Bot]

https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Move_fix-optionals

Comment 4

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

I cannot reproduce this bug with latest m-c debug build only my environment. Do you still reproduce this bug?

Comment 5

[Jason Kratzer [:jkratzer]]

(In reply to Masayuki Nakano [:masayuki] (JST, +0900) from comment #4)
> I cannot reproduce this bug with latest m-c debug build only my environment.
> Do you still reproduce this bug?

I can no longer reproduce this issue using the latest m-c debug build.

Comment 6

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Thank you.