1508104 - Assertion failure: index >= 0, at src/layout/generic/nsFrame.cpp:4855

Status: NEW

(Core :: Layout, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced with m-c:
BuildID=20181117163821
SourceStamp=94debc6ca20b5f9e8d2e617430673dd94139c4e9

Assertion failure: index >= 0, at src/layout/generic/nsFrame.cpp:4855

#0 GetRangeForFrame(nsIFrame*) src/layout/generic/nsFrame.cpp:4855:3
#1 nsIFrame::PeekOffset(nsPeekOffsetStruct*) src/layout/generic/nsFrame.cpp:8549:29
#2 nsCaret::GetCaretFrameForNodeOffset(nsFrameSelection*, nsIContent*, int, mozilla::CaretAssociationHint, unsigned char, nsIFrame**, int*) src/layout/base/nsCaret.cpp:738:23
#3 nsCaret::GetFrameAndOffset(mozilla::dom::Selection*, nsINode*, int, int*) src/layout/base/nsCaret.cpp:406:17
#4 nsCaret::SchedulePaint(mozilla::dom::Selection*) src/layout/base/nsCaret.cpp:438:21
#5 mozilla::PresShell::SetCaretEnabled(bool) src/layout/base/PresShell.cpp:2226:15
#6 non-virtual thunk to mozilla::PresShell::SetCaretEnabled(bool) src/layout/base/PresShell.cpp
#7 mozilla::EditorBase::FinalizeSelection() src/editor/libeditor/EditorBase.cpp:4830:24
#8 nsFocusManager::ContentRemoved(nsIDocument*, nsIContent*) src/dom/base/nsFocusManager.cpp:880:25
#9 mozilla::EventStateManager::ContentRemoved(nsIDocument*, nsIContent*) src/dom/events/EventStateManager.cpp:5654:9
#10 mozilla::PresShell::ContentRemoved(nsIContent*, nsIContent*) src/layout/base/PresShell.cpp:4586:38
#11 nsNodeUtils::ContentRemoved(nsINode*, nsIContent*, nsIContent*) src/dom/base/nsNodeUtils.cpp:230:3
#12 nsINode::RemoveChildNode(nsIContent*, bool) src/dom/base/nsINode.cpp:2042:5
#13 mozilla::dom::FragmentOrElement::SetInnerHTMLInternal(nsTSubstring<char16_t> const&, mozilla::ErrorResult&) src/dom/base/FragmentOrElement.cpp:2299:13
#14 mozilla::dom::Element_Binding::set_innerHTML(JSContext*, JS::Handle<JSObject*>, mozilla::dom::Element*, JSJitSetterCallArgs) src/obj-firefox/dom/bindings/ElementBinding.cpp:3737:9
#15 bool mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::NormalThisPolicy>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3320:8
#16 CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:468:15
#17 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:560:16
#18 InternalCall(JSContext*, js::AnyInvokeArgs const&) src/js/src/vm/Interpreter.cpp:614:12
#19 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) src/js/src/vm/Interpreter.cpp:633:10
#20 js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) src/js/src/vm/Interpreter.cpp:775:12
#21 SetExistingProperty(JSContext*, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyResult>, JS::ObjectOpResult&) src/js/src/vm/NativeObject.cpp:3016:10
#22 bool js::NativeSetProperty<(js::QualifiedBool)1>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) src/js/src/vm/NativeObject.cpp:3046:20
#23 js::SetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) src/js/src/vm/ObjectOperations-inl.h:298:12
#24 SetPropertyOperation(JSContext*, JSOp, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::Handle<JS::Value>) src/js/src/vm/Interpreter.cpp:277:12
#25 Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3241:10
#26 js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:447:12
#27 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:587:15
#28 InternalCall(JSContext*, js::AnyInvokeArgs const&) src/js/src/vm/Interpreter.cpp:614:12
#29 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) src/js/src/vm/Interpreter.cpp:633:10
#30 JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/jsapi.cpp:2994:12
#31 mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) src/obj-firefox/dom/bindings/EventHandlerBinding.cpp:265:37
#32 void mozilla::dom::EventHandlerNonNull::Call<nsISupports*>(nsISupports* const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) src/obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:363:12
#33 mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) src/dom/events/JSEventHandler.cpp:214:12
#34 mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1115:52
#35 mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1317:15
#36 mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:425:17
#37 mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:642:16
#38 mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1164:11
#39 nsDocumentViewer::LoadComplete(nsresult) src/layout/base/nsDocumentViewer.cpp:1167:7
#40 nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) src/docshell/base/nsDocShell.cpp:7051:21
#41 nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp:6842:7
#42 non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp
#43 nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) src/uriloader/base/nsDocLoader.cpp:1309:3
#44 nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:852:14
#45 nsDocLoader::DocLoaderIsEmpty(bool) src/uriloader/base/nsDocLoader.cpp:741:9
#46 nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) src/uriloader/base/nsDocLoader.cpp:630:5
#47 non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) src/uriloader/base/nsDocLoader.cpp
#48 mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) src/netwerk/base/nsLoadGroup.cpp:630:28
#49 nsIDocument::DoUnblockOnload() src/dom/base/nsDocument.cpp:8488:18
#50 nsDocument::UnblockOnload(bool) src/dom/base/nsDocument.cpp:8410:9
#51 nsIDocument::DispatchContentLoadedEvents() src/dom/base/nsDocument.cpp:5306:3
#52 mozilla::detail::RunnableMethodImpl<nsIDocument*, void (nsIDocument::*)(), true, (mozilla::RunnableKind)0>::Run() src/obj-firefox/dist/include/nsThreadUtils.h:1242:13
#53 mozilla::SchedulerGroup::Runnable::Run() src/xpcom/threads/SchedulerGroup.cpp:337:32
#54 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1244:14
#55 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:530:10
#56 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:97:21
#57 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:325:10
#58 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:298:3
#59 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:158:27
#60 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:961:22
#61 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:269:9
#62 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:325:10
#63 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:298:3
#64 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:787:34
#65 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:50:30
#66 main src/browser/app/nsBrowserApp.cpp:287:18
#67 __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#68 _start (firefox+0x349f4)