Closed
Bug 1474966
Opened 6 years ago
Closed 2 years ago
Assertion failure: mUpdateCount > 0 (bad state), at /builds/worker/workspace/build/src/editor/libeditor/EditorBase.cpp:4135
Categories
(Core :: DOM: Editor, defect, P3)
Core
DOM: Editor
Tracking
()
RESOLVED
FIXED
108 Branch
Tracking | Status | |
---|---|---|
firefox-esr68 | --- | wontfix |
firefox-esr102 | --- | wontfix |
firefox62 | --- | wontfix |
firefox63 | --- | wontfix |
firefox69 | --- | wontfix |
firefox70 | --- | wontfix |
firefox71 | --- | wontfix |
firefox106 | --- | unaffected |
firefox107 | --- | unaffected |
firefox108 | --- | unaffected |
People
(Reporter: tsmith, Assigned: masayuki)
References
(Blocks 1 open bug)
Details
(Keywords: assertion, testcase)
Attachments
(2 files)
Reduced with m-c: BuildID=20180711094246 SourceStamp=aff060ad3204234adae2d59b3776207c6687ebfc Assertion failure: mUpdateCount > 0 (bad state), at src/editor/libeditor/EditorBase.cpp:4135 #0 mozilla::EditorBase::EndUpdateViewBatch() src/editor/libeditor/EditorBase.cpp:4135:3 #1 mozilla::HTMLEditor::EndUpdateViewBatch() src/editor/libeditor/HTMLEditor.cpp:4574:29 #2 mozilla::EditorBase::EndTransaction() src/editor/libeditor/EditorBase.cpp:898:3 #3 mozilla::StyleUpdatingCommand::ToggleState(mozilla::HTMLEditor*) src/editor/libeditor/HTMLEditorCommands.cpp:282:16 #4 mozilla::StateUpdatingCommandBase::DoCommand(char const*, nsISupports*) src/editor/libeditor/HTMLEditorCommands.cpp:99:10 #5 nsControllerCommandTable::DoCommand(char const*, nsISupports*) src/dom/commandhandler/nsControllerCommandTable.cpp:147:26 #6 nsBaseCommandController::DoCommand(char const*) src/dom/commandhandler/nsBaseCommandController.cpp:136:25 #7 nsCommandManager::DoCommand(char const*, nsICommandParams*, mozIDOMWindowProxy*) src/dom/commandhandler/nsCommandManager.cpp:212:22 #8 nsHTMLDocument::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) src/dom/html/nsHTMLDocument.cpp:3005:18 #9 mozilla::dom::HTMLDocument_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, nsHTMLDocument*, JSJitMethodCallArgs const&) src/obj-firefox/dom/bindings/HTMLDocumentBinding.cpp:577:21 #10 bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3306:13 #11 CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:444:15 #12 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:532:16 #13 InternalCall(JSContext*, js::AnyInvokeArgs const&) src/js/src/vm/Interpreter.cpp:583:12 #14 Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3237:18 #15 js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:424:12 #16 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:556:15 #17 InternalCall(JSContext*, js::AnyInvokeArgs const&) src/js/src/vm/Interpreter.cpp:583:12 #18 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) src/js/src/vm/Interpreter.cpp:602:10 #19 JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/jsapi.cpp:2887:12 #20 mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) src/obj-firefox/dom/bindings/EventHandlerBinding.cpp:264:37 #21 void mozilla::dom::EventHandlerNonNull::Call<nsISupports*>(nsISupports* const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) src/obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:363:12 #22 mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) src/dom/events/JSEventHandler.cpp:214:12 #23 mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1122:52 #24 mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1329:20 #25 mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:418:17 #26 mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:635:16 #27 mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1110:9 #28 nsDocumentViewer::LoadComplete(nsresult) src/layout/base/nsDocumentViewer.cpp:1169:7 #29 nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) src/docshell/base/nsDocShell.cpp:7057:21 #30 nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp:6850:7 #31 non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp #32 nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) src/uriloader/base/nsDocLoader.cpp:1309:3 #33 nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:852:14 #34 nsDocLoader::DocLoaderIsEmpty(bool) src/uriloader/base/nsDocLoader.cpp:741:9 #35 nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) src/uriloader/base/nsDocLoader.cpp:627:5 #36 non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) src/uriloader/base/nsDocLoader.cpp #37 mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) src/netwerk/base/nsLoadGroup.cpp:629:28 #38 nsIDocument::DoUnblockOnload() src/dom/base/nsDocument.cpp:8250:18 #39 nsDocument::UnblockOnload(bool) src/dom/base/nsDocument.cpp:8172:9 #40 nsIDocument::DispatchContentLoadedEvents() src/dom/base/nsDocument.cpp:5065:3 #41 mozilla::detail::RunnableMethodImpl<nsIDocument*, void (nsIDocument::*)(), true, (mozilla::RunnableKind)0>::Run() src/obj-firefox/dist/include/nsThreadUtils.h:1217:13 #42 mozilla::SchedulerGroup::Runnable::Run() src/xpcom/threads/SchedulerGroup.cpp:337:32 #43 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1051:14 #44 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:519:10 #45 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:97:21 #46 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:325:10 #47 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:298:3 #48 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:158:27 #49 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:920:22 #50 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:269:9 #51 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:325:10 #52 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:298:3 #53 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:746:34 #54 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:50:30 #55 main src/browser/app/nsBrowserApp.cpp:287:18 #56 __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291 #57 _start (firefox+0x423724)
Flags: in-testsuite?
Updated•6 years ago
|
Priority: -- → P3
Reporter | ||
Updated•5 years ago
|
status-firefox69:
--- → wontfix
status-firefox70:
--- → affected
status-firefox71:
--- → affected
status-firefox-esr68:
--- → affected
Reporter | ||
Comment 1•5 years ago
|
||
A Pernosco session can be found here: https://pernos.co/debug/l3XAw4JGEbqBKl2zRVp8sg/index.html
Reporter | ||
Comment 2•2 years ago
|
||
The attached test case no longer reproduces the issue. This was last reported by fuzzers targeting m-c 20210408-970ef713fe58.
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → WORKSFORME
Assignee | ||
Comment 3•2 years ago
|
||
I'll add the reported testcase into the tree.
Assignee: nobody → masayuki
Status: RESOLVED → REOPENED
status-firefox106:
--- → unaffected
status-firefox107:
--- → unaffected
status-firefox108:
--- → unaffected
OS: Unspecified → All
Hardware: Unspecified → All
Resolution: WORKSFORME → ---
Assignee | ||
Comment 4•2 years ago
|
||
Pushed by masayuki@d-toybox.com: https://hg.mozilla.org/integration/autoland/rev/d213fc718538 Add reported testcase to WPT r=m_kato
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/36562 for changes under testing/web-platform/tests
Comment 7•2 years ago
|
||
bugherder |
Status: REOPENED → RESOLVED
Closed: 2 years ago → 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → 108 Branch
Upstream PR merged by moz-wptsync-bot
Updated•2 years ago
|
status-firefox-esr102:
--- → wontfix
Flags: in-testsuite? → in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•