1626291 - Assertion failure: uint32_t(startOffset) <= startContainer->Length() && uint32_t(endOffset) <= endContainer->Length(), at /builds/worker/checkouts/gecko/dom/base/ContentIterator.cpp:721

Status: RESOLVED FIXED

(Core :: DOM: Selection, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev e1672b3231e9 (built with --enable-debug). Testcase must be served over HTTP in order to reproduce.

Assertion failure: uint32_t(startOffset) <= startContainer->Length() && uint32_t(endOffset) <= endContainer->Length(), at /builds/worker/checkouts/gecko/dom/base/ContentIterator.cpp:721

rax = 0x00005564953e5380   rdx = 0x0000000000000000
rcx = 0x00007fc47b5583be   rbx = 0x00007ffeab3f5570
rsi = 0x00007fc4872c78b0   rdi = 0x00007fc4872c6680
rbp = 0x00007ffeab3f5510   rsp = 0x00007ffeab3f54c0
r8 = 0x00007fc4872c78b0    r9 = 0x00007fc48842d780
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x00007fc46dbf6f70   r13 = 0x00007fc46dbf6f70
r14 = 0x0000000000000005   r15 = 0x0000000000000000
rip = 0x00007fc4764f9b16
OS|Linux|0.0.0 Linux 5.3.0-28-generic #30~18.04.1-Ubuntu SMP Fri Jan 17 06:14:09 UTC 2020 x86_64
CPU|amd64|family 6 model 94 stepping 3|8
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::ContentSubtreeIterator::InitWithRange()|hg:hg.mozilla.org/mozilla-central:dom/base/ContentIterator.cpp:e1672b3231e9e612465168f16190a1392b422517|710|0x34
0|1|libxul.so|mozilla::dom::Selection::SelectFrames(nsPresContext*, nsRange*, bool) const|hg:hg.mozilla.org/mozilla-central:dom/base/Selection.cpp:e1672b3231e9e612465168f16190a1392b422517|1502|0xb
0|2|libxul.so|mozilla::dom::Selection::Repaint(nsPresContext*)|hg:hg.mozilla.org/mozilla-central:dom/base/Selection.cpp:e1672b3231e9e612465168f16190a1392b422517|1656|0x25
0|3|libxul.so|mozilla::PresShell::FrameSelectionWillTakeFocus(nsFrameSelection&)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:e1672b3231e9e612465168f16190a1392b422517|1602|0xd
0|4|libxul.so|mozilla::PresShell::FrameSelectionWillLoseFocus(nsFrameSelection&)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:e1672b3231e9e612465168f16190a1392b422517|1574|0x8
0|5|libxul.so|mozilla::TextControlState::UnbindFromFrame(nsTextControlFrame*)|hg:hg.mozilla.org/mozilla-central:dom/html/TextControlState.cpp:e1672b3231e9e612465168f16190a1392b422517|2391|0xd
0|6|libxul.so|nsTextControlFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&)|hg:hg.mozilla.org/mozilla-central:layout/forms/nsTextControlFrame.cpp:e1672b3231e9e612465168f16190a1392b422517|145|0x14
0|7|libxul.so|nsBlockFrame::DoRemoveFrameInternal(nsIFrame*, unsigned int, mozilla::layout::PostFrameDestroyData&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:e1672b3231e9e612465168f16190a1392b422517|6266|0x13
0|8|libxul.so|nsBlockFrame::DoRemoveFrame(nsIFrame*, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.h:e1672b3231e9e612465168f16190a1392b422517|528|0x18
0|9|libxul.so|nsBlockFrame::RemoveFrame(mozilla::layout::FrameChildListID, nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:e1672b3231e9e612465168f16190a1392b422517|5582|0x5
0|10|libxul.so|nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:e1672b3231e9e612465168f16190a1392b422517|7577|0x15
0|11|libxul.so|mozilla::PresShell::ContentRemoved(nsIContent*, nsIContent*)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:e1672b3231e9e612465168f16190a1392b422517|4371|0x1c
0|12|libxul.so|mozilla::dom::MutationObservers::NotifyContentRemoved(nsINode*, nsIContent*, nsIContent*)|hg:hg.mozilla.org/mozilla-central:dom/base/MutationObservers.cpp:e1672b3231e9e612465168f16190a1392b422517|215|0x81
0|13|libxul.so|nsINode::RemoveChildNode(nsIContent*, bool)|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:e1672b3231e9e612465168f16190a1392b422517|2052|0xe
0|14|libxul.so|nsINode::ReplaceOrInsertBefore(bool, nsINode*, nsINode*, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:e1672b3231e9e612465168f16190a1392b422517|2415|0x48
0|15|libxul.so|mozilla::dom::Node_Binding::appendChild|s3:gecko-generated-sources:5ccfed7011597cdaf63378523eba13c96c152b99d5afa74e8defe3eb58ea4e842ae4158b7511e9a2afb24ad1287cbab89b398f4e3d95ee29276613e3f97b06fd/dom/bindings/NodeBinding.cpp:|988|0x1a
0|16|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:e1672b3231e9e612465168f16190a1392b422517|3205|0x21
0|17|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:e1672b3231e9e612465168f16190a1392b422517|477|0x19
0|18|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:e1672b3231e9e612465168f16190a1392b422517|569|0x12
0|19|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:e1672b3231e9e612465168f16190a1392b422517|632|0x10
0|20|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:e1672b3231e9e612465168f16190a1392b422517|3028|0x16
0|21|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:e1672b3231e9e612465168f16190a1392b422517|410|0x152
0|22|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:e1672b3231e9e612465168f16190a1392b422517|604|0xf
0|23|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:e1672b3231e9e612465168f16190a1392b422517|632|0x10
0|24|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:e1672b3231e9e612465168f16190a1392b422517|649|0x8
0|25|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:e1672b3231e9e612465168f16190a1392b422517|2798|0x1f
0|26|libxul.so|mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)|s3:gecko-generated-sources:a39a0c7064327d8bf5f33af316b4cc9c9d3236184b2183673b9f8103182682809cdd62ab814947d309a2f0405582be39e80ec6d762aad6de8c66e51e15d2f95d/dom/bindings/EventHandlerBinding.cpp:|276|0x5
0|27|libxul.so|mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*)|hg:hg.mozilla.org/mozilla-central:dom/events/JSEventHandler.cpp:e1672b3231e9e612465168f16190a1392b422517|201|0x14e
0|28|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:e1672b3231e9e612465168f16190a1392b422517|1079|0xc
0|29|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:e1672b3231e9e612465168f16190a1392b422517|1271|0x1c
0|30|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:e1672b3231e9e612465168f16190a1392b422517|326|0x6b
0|31|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:e1672b3231e9e612465168f16190a1392b422517|558|0x12
0|32|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:e1672b3231e9e612465168f16190a1392b422517|1055|0x1a
0|33|libxul.so|nsDocumentViewer::LoadComplete(nsresult)|hg:hg.mozilla.org/mozilla-central:layout/base/nsDocumentViewer.cpp:e1672b3231e9e612465168f16190a1392b422517|1160|0x1a
0|34|libxul.so|nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:e1672b3231e9e612465168f16190a1392b422517|6072|0x18
0|35|libxul.so|nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:e1672b3231e9e612465168f16190a1392b422517|5855|0x1c
0|36|libxul.so|nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:e1672b3231e9e612465168f16190a1392b422517|1347|0x31
0|37|libxul.so|nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:e1672b3231e9e612465168f16190a1392b422517|907|0x2a
0|38|libxul.so|nsDocLoader::DocLoaderIsEmpty(bool)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:e1672b3231e9e612465168f16190a1392b422517|727|0x15
0|39|libxul.so|nsDocLoader::OnStopRequest(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:e1672b3231e9e612465168f16190a1392b422517|615|0x16
0|40|libxul.so|mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:e1672b3231e9e612465168f16190a1392b422517|611|0x1a
0|41|libxul.so|mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:e1672b3231e9e612465168f16190a1392b422517|518|0xe
0|42|libxul.so|mozilla::dom::Document::DoUnblockOnload()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:e1672b3231e9e612465168f16190a1392b422517|10754|0x4c
0|43|libxul.so|mozilla::dom::Document::UnblockOnload(bool)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:e1672b3231e9e612465168f16190a1392b422517|10688|0x2a
0|44|libxul.so|mozilla::dom::Document::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:e1672b3231e9e612465168f16190a1392b422517|7377|0xd
0|45|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:e1672b3231e9e612465168f16190a1392b422517|1220|0x5
0|46|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:e1672b3231e9e612465168f16190a1392b422517|282|0x14
0|47|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:e1672b3231e9e612465168f16190a1392b422517|1220|0xe
0|48|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:e1672b3231e9e612465168f16190a1392b422517|481|0x11
0|49|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:e1672b3231e9e612465168f16190a1392b422517|87|0xa
0|50|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:e1672b3231e9e612465168f16190a1392b422517|315|0x19
0|51|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:e1672b3231e9e612465168f16190a1392b422517|290|0x8
0|52|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:e1672b3231e9e612465168f16190a1392b422517|137|0xd
0|53|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:e1672b3231e9e612465168f16190a1392b422517|909|0x6
0|54|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:e1672b3231e9e612465168f16190a1392b422517|237|0x5
0|55|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:e1672b3231e9e612465168f16190a1392b422517|315|0x19
0|56|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:e1672b3231e9e612465168f16190a1392b422517|290|0x8
0|57|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:e1672b3231e9e612465168f16190a1392b422517|740|0xc
0|58|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:e1672b3231e9e612465168f16190a1392b422517|56|0x14
0|59|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:e1672b3231e9e612465168f16190a1392b422517|303|0x13
0|60|libc.so.6||||0x21b97
0|61|firefox-bin|__cxa_throw_bad_array_new_length|hg:hg.mozilla.org/mozilla-central:build/unix/stdc++compat/stdc++compat.cpp:e1672b3231e9e612465168f16190a1392b422517|82|0x12
0|62|firefox-bin|_GLOBAL__sub_I_TimeStamp.cpp|hg:hg.mozilla.org/mozilla-central:mozglue/misc/TimeStamp.cpp:e1672b3231e9e612465168f16190a1392b422517|150|0x4b
0|63|||||0x7ffeab3f9620
0|64|ld-linux-x86-64.so.2||||0x10733
0|65|libdl.so.2||||0x202d80
0|66|libpthread.so.0||||0x219bb0
0|67|firefox-bin|_GLOBAL__sub_I_TimeStamp.cpp|hg:hg.mozilla.org/mozilla-central:mozglue/misc/TimeStamp.cpp:e1672b3231e9e612465168f16190a1392b422517|150|0x4b
0|68|||||0x7ffeab3f9620
0|69|firefox-bin|_start|||0x29

Comment 1

[Anne (:annevk)]

Masayuki, this looks like "your" assert.

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Interesting. PresShell::FrameSelectionWillTakeFocus() is called with PresShell::mSelection because the previous independent nsFrameSelection for <input> element is blurring since it's temporarily removed from the DOM tree. However, at that time, nsRange::ContentRemoved() of first range of Selection for the document has not been called yet. Therefore, it selects all contents of the <body> element by which the <input> element is included. Therefore, the end offset is not valid. I guess that Selection::Repaint() should put off to handle SelectFrames after running all mutation observers. What do you think, emilio?

Comment 3

[Emilio Cobos Álvarez (:emilio)]

We could conceivably move the repaint call to a script runner if needed, yeah, though it's a slightly unfortunate. Do you want me to take this?

Comment 4

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

(In reply to Emilio Cobos Álvarez (:emilio) from comment #3)

We could conceivably move the repaint call to a script runner if needed, yeah, though it's a slightly unfortunate. Do you want me to take this?

Yeah, if you have much time.

Comment 5

[Emilio Cobos Álvarez (:emilio)]

Sure thing.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Comment 7

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1626291 - Repaint selection when safe. r=masayuki

Note that we intentionally don't move the SetDisplaySelection stuff to the
runnables. It would probably be safe enough, but it's not required and it makes
reasoning about this code harder.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a2eb8e771d45
Repaint selection when safe. r=masayuki

Comment 9

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/22830 for changes under testing/web-platform/tests

Comment 10

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Can't merge web-platform-tests PR due to failing upstream checks:
Github PR https://github.com/web-platform-tests/wpt/pull/22830
* Community-TC (pull_request) (https://community-tc.services.mozilla.com/tasks/groups/T2QciQT3SQSEdrMQNpjwgw)

Comment 11

[Emilio Cobos Álvarez (:emilio)]

Seems like the chrome-stability task failed, but due to an unrelated error.

Comment 12

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/mozilla-central/rev/a2eb8e771d45

Comment 13

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by jgraham

Comment 14

[Ryan VanderMeulen [:RyanVM]]

Is there a user impact which justifies backport consideration or can this fix ride 77 to release?

Comment 15

[Emilio Cobos Álvarez (:emilio)]

I defer to masayuki on the impact of violating this assertion. But this should be very safe to uplift anyhow.

Comment 16

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Yeah, this should be enough safe, and I think that there is no option to fix this under current design. And I'm pretty afraid to the stack. So, I recommend to uplift it (in other words, the case is not usual case, so that it shouldn't break normal web apps).

Comment 17

[Emilio Cobos Álvarez (:emilio)]

Comment on attachment 9139130 [details]
Bug 1626291 - Repaint selection when safe. r=masayuki

Beta/Release Uplift Approval Request

• User impact if declined: Unclear
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Defers an invalidation operation to slightly later. Close to zero regression risk IMHO.
• String changes made/needed: none

Comment 18

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9139130 [details]
Bug 1626291 - Repaint selection when safe. r=masayuki

Approved for 76.0b5.

Comment 19

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/2205f4167431