1662302 - Assertion failure: child->IsDocument(), at src/dom/base/Document.cpp:12176

Status: NEW

(Core :: Print Preview, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced with m-c 20200830-a4b27ed1a68e

Assertion failure: child->IsDocument(), at src/dom/base/Document.cpp:12176

#0 0x7f3c9f04624f in AnnotateMozCrashReason /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:42:19
#1 0x7f3c9f04624f in mozilla::dom::GetCorrespondingNodeInDocument(nsINode const*, mozilla::dom::Document&) src/dom/base/Document.cpp:12176:3
#2 0x7f3c9effa0c4 in CachePrintSelectionRanges src/dom/base/Document.cpp:12241:9
#3 0x7f3c9effa0c4 in mozilla::dom::Document::CreateStaticClone(nsIDocShell*) src/dom/base/Document.cpp:12333:5
#4 0x7f3c9ef0743d in nsGlobalWindowOuter::Print(nsIPrintSettings*, nsIWebProgressListener*, nsIDocShell*, bool, mozilla::ErrorResult&) src/dom/base/nsGlobalWindowOuter.cpp:5390:27
#5 0x7f3c9eed9d98 in nsGlobalWindowInner::PrintPreview(nsIPrintSettings*, nsIWebProgressListener*, nsIDocShell*, mozilla::ErrorResult&) src/dom/base/nsGlobalWindowInner.cpp:3614:3
#6 0x7f3c9fdd7025 in mozilla::dom::Window_Binding::printPreview(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/WindowBinding.cpp:3205:59
#7 0x7f3ca0376253 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3227:13
#8 0x7f3ca3218e71 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:507:13
#9 0x7f3ca32185e2 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:599:12
#10 0x7f3ca321a1af in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:664:10
#11 0x7f3ca320db58 in CallFromStack src/js/src/vm/Interpreter.cpp:668:10
#12 0x7f3ca320db58 in Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3336:16
#13 0x7f3ca32043b3 in js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:468:13
#14 0x7f3ca321859f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:636:13
#15 0x7f3ca321a1af in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:664:10
#16 0x7f3ca321a38f in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) src/js/src/vm/Interpreter.cpp:681:8
#17 0x7f3ca3329537 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/jsapi.cpp:2831:10
#18 0x7f3c9fc795ce in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::IdleDeadline&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/WindowBinding.cpp:865:8
#19 0x7f3c9ef5701a in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::IdleDeadline&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/WindowBinding.h:784:12
#20 0x7f3c9f03f1d9 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/WindowBinding.h:797:12
#21 0x7f3c9f03f1d9 in mozilla::dom::IdleRequest::IdleRun(nsPIDOMWindowInner*, double, bool) src/dom/base/IdleRequest.cpp:62:13
#22 0x7f3c9eec65b0 in nsGlobalWindowInner::RunIdleRequest(mozilla::dom::IdleRequest*, double, bool) src/dom/base/nsGlobalWindowInner.cpp:672:12
#23 0x7f3c9eec5a25 in nsGlobalWindowInner::ExecuteIdleRequest(mozilla::TimeStamp) src/dom/base/nsGlobalWindowInner.cpp:700:3
#24 0x7f3c9eec5854 in IdleRequestExecutor::Run() src/dom/base/nsGlobalWindowInner.cpp:541:13
#25 0x7f3c9d1b76f4 in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:242:16
#26 0x7f3c9d1b54bd in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:512:26
#27 0x7f3c9d1b46a6 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:394:15
#28 0x7f3c9d1b47a7 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:168:36
#29 0x7f3c9d1bc136 in operator() src/xpcom/threads/TaskController.cpp:83:37
#30 0x7f3c9d1bc136 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_4>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:577:5
#31 0x7f3c9d1cf368 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1234:14
#32 0x7f3c9d1d4d3a in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:513:10
#33 0x7f3c9db0026f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:87:21
#34 0x7f3c9da707b3 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:334:10
#35 0x7f3c9da706cd in RunHandler src/ipc/chromium/src/base/message_loop.cc:327:3
#36 0x7f3c9da706cd in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:309:3
#37 0x7f3ca18a25d8 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#38 0x7f3ca30d6713 in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:913:20
#39 0x7f3c9db01037 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:237:9
#40 0x7f3c9da707b3 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:334:10
#41 0x7f3c9da706cd in RunHandler src/ipc/chromium/src/base/message_loop.cc:327:3
#42 0x7f3c9da706cd in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:309:3
#43 0x7f3ca30d62ec in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:744:34
#44 0x56124295b09f in content_process_main src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#45 0x56124295b09f in main src/browser/app/nsBrowserApp.cpp:303:18

Comment 1

[Hiroyuki Ikezoe (:hiro)]

The assertion is here, and the child node is the body element, but at the moment it looks like the body element has already detached from the document due to document.documentElement.innerText = String.fromCodePoint() line in the test case (presumably, I don't know exactly what String.fromCodePOint() returns).

What I don't quite understand is why PresShell::GetCurrentSelection includes detached nodes?
Maybe I am totally misundestanding these stuff since I am not familiar with them.

Comment 2

[Hiroyuki Ikezoe (:hiro)]

Looks like this assertion is harmless in this particular case since even if the child is not a document node, we will end up not finding the corresponding node in the cloned document, thus we will ignore the node.