1535112 - Assertion failure: !mRootContent->IsText(), at src/dom/events/ContentEventHandler.cpp:1216

Status: NEW

(Core :: DOM: Selection, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Assertion failure: !mRootContent->IsText(), at src/dom/events/ContentEventHandler.cpp:1216

#0 mozilla::ContentEventHandler::SetRawRangeFromFlatTextOffset(mozilla::ContentEventHandler::RawRange*, unsigned int, unsigned int, mozilla::LineBreakType, bool, unsigned int*, nsIContent**) src/dom/events/ContentEventHandler.cpp:1216:5
#1 mozilla::ContentEventHandler::OnQueryTextContent(mozilla::WidgetQueryContentEvent*) src/dom/events/ContentEventHandler.cpp:1425:8
#2 mozilla::IMEContentObserver::HandleQueryContentEvent(mozilla::WidgetQueryContentEvent*) src/dom/events/IMEContentObserver.cpp:756:25
#3 mozilla::EventStateManager::HandleQueryContentEvent(mozilla::WidgetQueryContentEvent*) src/dom/events/EventStateManager.cpp:900:22
#4 mozilla::EventStateManager::PreHandleEvent(nsPresContext*, mozilla::WidgetEvent*, nsIFrame*, nsIContent*, nsEventStatus*, nsIContent*) src/dom/events/EventStateManager.cpp:494:5
#5 mozilla::PresShell::EventHandler::DispatchEvent(mozilla::EventStateManager*, mozilla::WidgetEvent*, bool, nsEventStatus*, nsIContent*) src/layout/base/PresShell.cpp:7727:39
#6 mozilla::PresShell::EventHandler::HandleEventWithCurrentEventInfo(mozilla::WidgetEvent*, nsEventStatus*, bool, nsIContent*) src/layout/base/PresShell.cpp:7696:17
#7 mozilla::PresShell::EventHandler::HandleEventAtFocusedContent(mozilla::WidgetGUIEvent*, nsEventStatus*) src/layout/base/PresShell.cpp:7455:17
#8 mozilla::PresShell::EventHandler::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) src/layout/base/PresShell.cpp:6544:12
#9 mozilla::PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) src/layout/base/PresShell.cpp:6448:23
#10 nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*) src/view/nsViewManager.cpp:755:14
#11 nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool) src/view/nsView.cpp:1070:9
#12 mozilla::widget::PuppetWidget::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&) src/widget/PuppetWidget.cpp:380:37
#13 mozilla::ContentCacheInChild::CacheText(nsIWidget*, mozilla::widget::IMENotification const*) src/widget/ContentCache.cpp:234:12
#14 mozilla::widget::PuppetWidget::NotifyIMEOfTextChange(mozilla::widget::IMENotification const&) src/widget/PuppetWidget.cpp:817:7
#15 mozilla::widget::TextEventDispatcher::NotifyIME(mozilla::widget::IMENotification const&) src/widget/TextEventDispatcher.cpp:461:40
#16 nsBaseWidget::NotifyIME(mozilla::widget::IMENotification const&) src/widget/nsBaseWidget.cpp:1724:43
#17 mozilla::IMEStateManager::NotifyIME(mozilla::widget::IMENotification const&, nsIWidget*, mozilla::dom::TabParent*) src/dom/events/IMEStateManager.cpp:1684:22
#18 mozilla::IMEContentObserver::IMENotificationSender::SendTextChange() src/dom/events/IMEContentObserver.cpp:1972:3
#19 mozilla::IMEContentObserver::IMENotificationSender::Run() src/dom/events/IMEContentObserver.cpp:1728:5
#20 nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1827:13
#21 mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:319:7
#22 mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:336:5
#23 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:697:16
#24 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:592:9
#25 mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) src/layout/ipc/VsyncChild.cpp:65:16
#26 mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:168:54
#27 mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:2828:28
#28 mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2151:21
#29 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2078:9
#30 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1937:3
#31 mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1968:13
#32 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1179:14
#33 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:482:10
#34 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:88:21
#35 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#36 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#37 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#38 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:933:20
#39 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:238:9
#40 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#41 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#42 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:771:34
#43 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#44 main src/browser/app/nsBrowserApp.cpp:265:18

Comment 1

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Hi Andrew, since you added this assertion, I guess you may want to take a look. :)

Comment 2

[Andrew McCreight [:mccr8]]

Hopefully Boris has more of a quick idea of what might be going wrong here.

Comment 3

[Boris Zbarsky [:bzbarsky]]

The assert before Andrew touched it should have been equivalent...

I tried loading the testcase on Linux, as both an https:// URL from bugzilla and a file:// URL, but it doesn't assert for me. Tyson, do you see the problem reliably? Any hints on reproducing?

Comment 4

[Tyson Smith [:tsmith]]

Hmm strange.
I just tested with debug build m-c:
BuildID=20190321001227
SourceStamp=74b3bf36f5e8de101af0cc683bd1f20845e2087d

I was able to reproduce it by opening the test case from the filesystem and hitting F5 a couple times. I did use a clean profile (default prefs). I tested on Ubuntu 16.04.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Hmm. I got this to reproduce after a few reloads now.

mRootContent is an nsTextNode. So the assert from before 1449670 would have triggered as well. We do in fact have text here.

I have an rr trace now (which I packed in case someone else wants to debug; for my later reference it's ~/.local/share/rr/firefox-126, and the assert is in process 2070 at event 908045).

What seems to be going on is that mozilla::ContentEventHandler::InitRootContent is called with a selection containing one range. That range starts and ends at offset 10 in a textnode. The textnode contains the text "High Grade"; it's autogenerated by the keygen. The parent of the textnode is a <select>. The textnode is a root of a native anonymous subtree.

We call startNode->GetSelectionRootContent(), which returns the node itself, because it's not in the same anonymous subtree as the editor root (the <body> in this case).

All of that seems kind of plausible. So the real question is why this code think mRootContent shouldn't be text... Nakano-san, do you happen to know?

Comment 6

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

The reason is, ContentEventHandler::mRootContent in such case should be <body> or <html> (I forgot the detail) and not in native anonymous subtree since selection shouldn't be in it. Sounds like that this is another case of bug 1511563. My patch in it might fix this crash.

Comment 7

[Boris Zbarsky [:bzbarsky]]

https://phabricator.services.mozilla.com/D14847 would certainly avoid the state that I was seeing; that is exactly what is going on here: selection in a textnode inside the <select> generated for <keygen>.

Comment 8

[Olli Pettay [:smaug][[e-mail]]]

masayuki, could you take a look at this once you have time?

Comment 9

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Sure. But the nsFrameSelection::MoveCaret() wasn't agreed in bug 1511563. I need to investigate more though.

Comment 10

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Resetting assignee which I don't work on in this several months.