1648564 - Assertion failure: !aPointAtASCIIWhiteSpace.IsEndOfContainer(), at /builds/worker/checkouts/gecko/editor/libeditor/WSRunObject.cpp:1450

Status: VERIFIED FIXED

(Core :: DOM: Editor, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev db74cdf9afe7 (built with --enable-debug).

Assertion failure: !aPointAtASCIIWhiteSpace.IsEndOfContainer(), at /builds/worker/checkouts/gecko/editor/libeditor/WSRunObject.cpp:1450

rax = 0x00007f983707622e   rdx = 0x0000000000000000
rcx = 0x000056086df30a58   rbx = 0x00007ffc68ccbab0
rsi = 0x00007f984809a8b0   rdi = 0x00007f9848099680
rbp = 0x00007ffc68ccba50   rsp = 0x00007ffc68ccb980
r8 = 0x00007f984809a8b0    r9 = 0x00007f9849200780
r10 = 0x0000000000000002   r11 = 0x0000000000000000
r12 = 0x00007ffc68ccbc80   r13 = 0x00007ffc68ccba80
r14 = 0x00007ffc68ccbab0   r15 = 0x00007ffc68ccbb78
rip = 0x00007f98317e5e52
OS|Linux|0.0.0 Linux 5.3.0-51-generic #44~18.04.2-Ubuntu SMP Thu Apr 23 14:27:18 UTC 2020 x86_64
CPU|amd64|family 6 model 94 stepping 3|8
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::WSRunScanner::GetEndOfCollapsibleASCIIWhiteSpaces(mozilla::EditorDOMPointBase<RefPtr<mozilla::dom::Text>, nsIContent*> const&) const|hg:hg.mozilla.org/mozilla-central:editor/libeditor/WSRunObject.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|1450|0x29
0|1|libxul.so|mozilla::WSRunObject::PrepareToDeleteRangePriv(mozilla::WSRunObject*)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/WSRunObject.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|1187|0x12
0|2|libxul.so|mozilla::WSRunObject::PrepareToDeleteRange(mozilla::HTMLEditor&, mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> >*, mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> >*)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/WSRunObject.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|143|0xb
0|3|libxul.so|mozilla::HTMLEditor::HandleDeleteNonCollapsedSelection(short, short, mozilla::HTMLEditor::SelectionWasCollapsed)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/HTMLEditSubActionHandler.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|3212|0x5
0|4|libxul.so|mozilla::HTMLEditor::HandleDeleteSelectionInternal(short, short)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/HTMLEditSubActionHandler.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|2531|0x10
0|5|libxul.so|mozilla::HTMLEditor::HandleDeleteSelection(short, short)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/HTMLEditSubActionHandler.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|2370|0x13
0|6|libxul.so|mozilla::EditorBase::DeleteSelectionAsSubAction(short, short)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/EditorBase.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|3762|0x14
0|7|libxul.so|mozilla::EditorBase::DeleteSelectionAsAction(short, short, nsIPrincipal*)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/EditorBase.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|3731|0x12
0|8|libxul.so|mozilla::DeleteCommand::DoCommand(mozilla::Command, mozilla::TextEditor&, nsIPrincipal*) const|hg:hg.mozilla.org/mozilla-central:editor/libeditor/EditorCommands.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|619|0x7
0|9|libxul.so|mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|4852|0x33
0|10|libxul.so|mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&)|s3:gecko-generated-sources:8f7281e3ba1d600673dcaa1ac04d192ebae5bd1389403ef4cb1737261df8d246aba5da557aa502b708e3a3d18afebea6aedb14885532cb2904ce3fbf2ec40b9f/dom/bindings/DocumentBinding.cpp:|3469|0x34
0|11|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|3219|0x21
0|12|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|484|0x12
0|13|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|576|0xe
0|14|libxul.so|InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|639|0x10
0|15|libxul.so|Interpret(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|643|0xa
0|16|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|456|0xb
0|17|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|611|0x8
0|18|libxul.so|InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|639|0x10
0|19|libxul.so|<name omitted>|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|656|0xb
0|20|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|2846|0x23
0|21|libxul.so|mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)|s3:gecko-generated-sources:2563ad09677feb8ddf64827a409899848ef6a80bfacaa11f581c512536a6fb0c779d8b29517ba6358a054c6d475f770bf7bac2913a941d0394881c5649b08603/dom/bindings/EventListenerBinding.cpp:|55|0xe
0|22|libxul.so|void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:99837b3cdc69c5eb1234f9d2b3e771dcff734d56a022bedb1d00c0cf4ee6243fb5c91397a058f2ddab63bda8ed6b581ea1232a0229033866910c7289d24cbc2d/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x21
0|23|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|1082|0x2c
0|24|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|1279|0x15
0|25|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|355|0xb
0|26|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|557|0x19
0|27|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|1054|0x5
0|28|libxul.so|nsDocumentViewer::LoadComplete(nsresult)|hg:hg.mozilla.org/mozilla-central:layout/base/nsDocumentViewer.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|1148|0x1c
0|29|libxul.so|nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|5684|0x18
0|30|libxul.so|nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|5426|0xb
0|31|libxul.so|non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|0|0x10
0|32|libxul.so|nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|1331|0x2b
0|33|libxul.so|nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|937|0x28
0|34|libxul.so|nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|757|0xe
0|35|libxul.so|nsDocLoader::OnStopRequest(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|640|0x12
0|36|libxul.so|non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|0|0xd
0|37|libxul.so|mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|615|0x14
0|38|libxul.so|mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|522|0xe
0|39|libxul.so|mozilla::dom::Document::DoUnblockOnload()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|10716|0x1c
0|40|libxul.so|mozilla::dom::Document::UnblockOnload(bool)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|10648|0x8
0|41|libxul.so|mozilla::dom::Document::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|7282|0xd
0|42|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|1238|0x17
0|43|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|146|0x11
0|44|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|1234|0xe
0|45|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|501|0xc
0|46|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|87|0x7
0|47|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|315|0x17
0|48|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|290|0x8
0|49|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|137|0xd
0|50|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|913|0xe
0|51|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|237|0x5
0|52|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|315|0x17
0|53|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|290|0x8
0|54|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|744|0x5
0|55|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|56|0x11
0|56|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|303|0x20
0|57|libc.so.6||||0x21b97
0|58|firefox-bin|<name omitted>|hg:hg.mozilla.org/mozilla-central:mfbt/UniquePtr.h:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|253|0x17

Comment 1

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200625161839-324d5257f6f7.
The bug appears to have been introduced in the following build range:
> Start: 0290a1549a6e1965f2f47027508dbc93b1db2024 (20200615071141)
> End: 8e0e2c27bc4b48f2786984b00193bcf4c49cd8de (20200615073857)
> Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=0290a1549a6e1965f2f47027508dbc93b1db2024&tochange=8e0e2c27bc4b48f2786984b00193bcf4c49cd8de

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Hmm, this assertion must detect a bug of GetFirstASCIIWhiteSpacePointCollapsedTo() which shouldn't return end of container.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1642594

Comment 4

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Odd... Once I attach to a content process, it won't hit the assertion...

Comment 5

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

This is caused by that the new methods, GetFirstASCIIWhiteSpacePointCollapsedTo() and GetEndOfCollapsibleASCIIWhiteSpaces() may return point in empty text node, but especially the former case, it's wrong. Therefore, they should ignore empty text nodes at the loops. This may change DOM tree modifying order (i.e., when empty text nodes are removed), but the result shouldn't be changed without edge cases with mutation event listeners. Therefore, we don't need to uplift the coming patch.

Comment 6

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Bug 1648564 - Make `WSRunScanner::GetFirstASCIIWhiteSpacePointCollapsedTo()` and `WSRunScanner::GetEndOfCollapsibleASCIIWhiteSpaces()` not return point in empty text node r=m_kato!

Although their callers may want to remove empty text nodes around white-space
sequence, but for now, we should make them not return empty text node because
the former's name means so, and the latter should behave similarly for
consistency.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/05c8d1a8485d
Make `WSRunScanner::GetFirstASCIIWhiteSpacePointCollapsedTo()` and `WSRunScanner::GetEndOfCollapsibleASCIIWhiteSpaces()` not return point in empty text node r=m_kato

Comment 8

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/05c8d1a8485d

Comment 9

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as fixed on rev mozilla-central 20200702152109-2d709e60c76e.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.