1403702 - Assertion failure: aOffset == -1 || (0 <= aOffset && AssertedCast<uint32_t>(aOffset) <= aParent->Length()) [@ mozilla::EditorBase::MoveNode]

Status: RESOLVED WORKSFORME

(Core :: DOM: Editor, defect, P1)

Description

[Tyson Smith [:tsmith]]

Attachment: test_case.html

Assertion failure: aOffset == -1 || (0 <= aOffset && AssertedCast<uint32_t>(aOffset) <= aParent->Length()), at /builds/worker/workspace/build/src/editor/libeditor/EditorBase.cpp:1809

#0 mozilla::EditorBase::MoveNode(nsIContent*, nsINode*, int) /src/editor/libeditor/EditorBase.cpp:1806:3
#1 mozilla::HTMLEditRules::MoveNodeSmart(nsIContent&, mozilla::dom::Element&, int*) /src/editor/libeditor/HTMLEditRules.cpp:3049:19
#2 mozilla::HTMLEditRules::MoveContents(mozilla::dom::Element&, mozilla::dom::Element&, int*) /src/editor/libeditor/HTMLEditRules.cpp:3090:7
#3 mozilla::HTMLEditRules::MoveNodeSmart(nsIContent&, mozilla::dom::Element&, int*) /src/editor/libeditor/HTMLEditRules.cpp:3063:11
#4 mozilla::HTMLEditRules::MoveContents(mozilla::dom::Element&, mozilla::dom::Element&, int*) /src/editor/libeditor/HTMLEditRules.cpp:3090:7
#5 mozilla::HTMLEditRules::MoveNodeSmart(nsIContent&, mozilla::dom::Element&, int*) /src/editor/libeditor/HTMLEditRules.cpp:3063:11
#6 mozilla::HTMLEditRules::MoveBlock(mozilla::dom::Element&, mozilla::dom::Element&, int, int) /src/editor/libeditor/HTMLEditRules.cpp:3020:9
#7 mozilla::HTMLEditRules::TryToJoinBlocks(nsIContent&, nsIContent&) /src/editor/libeditor/HTMLEditRules.cpp:2931:14
#8 mozilla::HTMLEditRules::WillDeleteSelection(mozilla::dom::Selection*, short, short, bool*, bool*) /src/editor/libeditor/HTMLEditRules.cpp:2349:11
#9 mozilla::HTMLEditRules::WillDoAction(mozilla::dom::Selection*, mozilla::RulesInfo*, bool*, bool*) /src/editor/libeditor/HTMLEditRules.cpp:652:14
#10 mozilla::TextEditor::DeleteSelection(short, short) /src/editor/libeditor/TextEditor.cpp:627:24
#11 mozilla::DeleteCommand::DoCommand(char const*, nsISupports*) /src/editor/libeditor/EditorCommands.cpp:791:22
#12 nsControllerCommandTable::DoCommand(char const*, nsISupports*) /src/dom/commandhandler/nsControllerCommandTable.cpp:147:26
#13 nsBaseCommandController::DoCommand(char const*) /src/dom/commandhandler/nsBaseCommandController.cpp:136:25
#14 nsCommandManager::DoCommand(char const*, nsICommandParams*, mozIDOMWindowProxy*) /src/dom/commandhandler/nsCommandManager.cpp:212:22
#15 nsHTMLDocument::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) /src/dom/html/nsHTMLDocument.cpp:3334:18
#16 mozilla::dom::HTMLDocumentBinding::execCommand(JSContext*, JS::Handle<JSObject*>, nsHTMLDocument*, JSJitMethodCallArgs const&) /src/obj-firefox/dom/bindings/HTMLDocumentBinding.cpp:891:21
#17 mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) /src/dom/bindings/BindingUtils.cpp:3055:13
#18 js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) /src/js/src/jscntxtinlines.h:293:15
#19 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /src/js/src/vm/Interpreter.cpp:495:16
#20 InternalCall(JSContext*, js::AnyInvokeArgs const&) /src/js/src/vm/Interpreter.cpp:540:12
#21 Interpret(JSContext*, js::RunState&) /src/js/src/vm/Interpreter.cpp:3084:18
#22 js::RunScript(JSContext*, js::RunState&) /src/js/src/vm/Interpreter.cpp:435:12
#23 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /src/js/src/vm/Interpreter.cpp:513:15
#24 InternalCall(JSContext*, js::AnyInvokeArgs const&) /src/js/src/vm/Interpreter.cpp:540:12
#25 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /src/js/src/vm/Interpreter.cpp:559:10
#26 JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /src/js/src/jsapi.cpp:2965:12
#27 mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /src/obj-firefox/dom/bindings/EventHandlerBinding.cpp:260:37
#28 void mozilla::dom::EventHandlerNonNull::Call<nsISupports*>(nsISupports* const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JSCompartment*) /src/obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:362:12
#29 mozilla::JSEventHandler::HandleEvent(nsIDOMEvent*) /src/dom/events/JSEventHandler.cpp:215:12
#30 mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) /src/dom/events/EventListenerManager.cpp:1112:51
#31 mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) /src/dom/events/EventListenerManager.cpp:1283:20
#32 mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /src/dom/events/EventDispatcher.cpp:313:17
#33 mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /src/dom/events/EventDispatcher.cpp:462:16
#34 mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /src/dom/events/EventDispatcher.cpp:822:9
#35 nsDocumentViewer::LoadComplete(nsresult) /src/layout/base/nsDocumentViewer.cpp:1081:7
#36 nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /src/docshell/base/nsDocShell.cpp:7749:21
#37 nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /src/docshell/base/nsDocShell.cpp:7547:7
#38 non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /src/docshell/base/nsDocShell.cpp:7444:13
#39 nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /src/uriloader/base/nsDocLoader.cpp:1320:3
#40 nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /src/uriloader/base/nsDocLoader.cpp:861:14
#41 nsDocLoader::DocLoaderIsEmpty(bool) /src/uriloader/base/nsDocLoader.cpp:750:9
#42 nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /src/uriloader/base/nsDocLoader.cpp:632:5
#43 non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /src/uriloader/base/nsDocLoader.cpp:488:14
#44 mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /src/netwerk/base/nsLoadGroup.cpp:629:28
#45 nsDocument::DoUnblockOnload() /src/dom/base/nsDocument.cpp:9231:18
#46 nsDocument::UnblockOnload(bool) /src/dom/base/nsDocument.cpp:9153:9
#47 nsDocument::DispatchContentLoadedEvents() /src/dom/base/nsDocument.cpp:5600:3
#48 mozilla::detail::RunnableMethodImpl<nsDocument*, void (nsDocument::*)(), true, (mozilla::RunnableKind)0>::Run() /src/obj-firefox/dist/include/nsThreadUtils.h:1192:13
#49 nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1039:14
#50 NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:521:10
#51 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:97:21
#52 MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#53 MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#54 nsBaseAppShell::Run() /src/widget/nsBaseAppShell.cpp:158:27
#55 nsAppStartup::Run() /src/toolkit/components/startup/nsAppStartup.cpp:288:30
#56 XREMain::XRE_mainRun() /src/toolkit/xre/nsAppRunner.cpp:4701:22
#57 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4865:8
#58 XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4960:21
#59 do_main(int, char**, char**) /src/browser/app/nsBrowserApp.cpp:236:22
#60 main /src/browser/app/nsBrowserApp.cpp:309:16
#61 __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#62 _start (firefox+0x41eb24)

Comment 1

[Ryan VanderMeulen [:RyanVM]]

INFO: Last good revision: ffdd1a398105 (2014-08-20)
INFO: First bad revision: dac8b4a0bd7c (2014-08-21)
INFO: Pushlog:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ffdd1a398105&tochange=dac8b4a0bd7c

Bug 1054735 or bug 1055032 seem likely. Also, this crashes regular opt builds too.

Comment 2

[Makoto Kato [:m_kato]]

Although I test on Windows and Linux, I don't hit assertion.