Assertion failure: mStart.EqualsOrIsBefore(mEnd), at EditorDOMPoint.h:1039 when replacing/deleting table cells
Categories
(Core :: DOM: Editor, defect, P3)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox84 | --- | fixed |
People
(Reporter: mbrodesser-Igalia, Assigned: masayuki)
References
Details
Attachments
(3 files)
(gdb) bt
#0 0x00007fffe2ff927d in mozilla::EditorDOMRangeBase<mozilla::EditorDOMPointBase<RefPtr<mozilla::dom::Text>, nsIContent*> >::EditorDOMRangeBase<mozilla::EditorDOMPointBase<RefPtr<mozilla::dom::Text>, nsIContent*>, mozilla::EditorDOMPointBase<RefPtr<mozilla::dom::Text>, nsIContent*> >(mozilla::EditorDOMPointBase<RefPtr<mozilla::dom::Text>, nsIContent*> const&, mozilla::EditorDOMPointBase<RefPtr<mozilla::dom::Text>, nsIContent*> const&) (this=0x7ffffffed8b8, aStart=..., aEnd=...)
at /home/mirko/src/firefox/gecko2/obj-x86_64-pc-linux-gnu-debug/dist/include/mozilla/EditorDOMPoint.h:1038
#1 0x00007fffe2feeb4d in mozilla::WSRunScanner::TextFragmentData::GetNonCollapsedRangeInTexts(mozilla::EditorDOMRangeBase<mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > > const&) const (this=0x7ffffffed8f8, aRange=...)
at /home/mirko/src/firefox/gecko2/editor/libeditor/WSRunObject.cpp:1715
#2 0x00007fffe2ff2d45 in mozilla::WSRunScanner::GetRangeContainingInvisibleWhiteSpacesAtRangeBoundaries(mozilla::HTMLEditor const&, mozilla::EditorDOMRangeBase<mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > > const&) (aHTMLEditor=..., aRange=...)
at /home/mirko/src/firefox/gecko2/editor/libeditor/WSRunObject.cpp:3495
#3 0x00007fffe2eeb1eb in mozilla::HTMLEditor::AutoDeleteRangesHandler::ComputeRangesToDeleteNonCollapsedRanges(mozilla::HTMLEditor const&, short, mozilla::AutoRangeArray&, mozilla::HTMLEditor::AutoDeleteRangesHandler::SelectionWasCollapsed) const (this=0x7ffffffee408, aHTMLEditor=..., aDirectionAndAmount=0, aRangesToDelete=..., aSelectionWasCollapsed=mozilla::HTMLEditor::AutoDeleteRangesHandler::SelectionWasCollapsed::No) at /home/mirko/src/firefox/gecko2/editor/libeditor/HTMLEditSubActionHandler.cpp:4999
#4 0x00007fffe2ee7266 in mozilla::HTMLEditor::AutoDeleteRangesHandler::ComputeRangesToDelete(mozilla::HTMLEditor const&, short, mozilla::AutoRangeArray&) (this=0x7ffffffee408, aHTMLEditor=..., aDirectionAndAmount=0, aRangesToDelete=...)
at /home/mirko/src/firefox/gecko2/editor/libeditor/HTMLEditSubActionHandler.cpp:3575
#5 0x00007fffe2ee5df4 in mozilla::HTMLEditor::ComputeTargetRanges(short, mozilla::AutoRangeArray&) (this=0x7fffaa20d400, aDirectionAndAmount=0, aRangesToDelete=...) at /home/mirko/src/firefox/gecko2/editor/libeditor/HTMLEditSubActionHandler.cpp:3278
#6 0x00007fffe2e89e73 in mozilla::EditorBase::AutoEditActionDataSetter::MaybeDispatchBeforeInputEvent(short) (this=0x7ffffffee738, aDeleteDirectionAndAmount=0) at /home/mirko/src/firefox/gecko2/editor/libeditor/EditorBase.cpp:5358
#7 0x00007fffe2eaa6f2 in mozilla::EditorBase::AutoEditActionDataSetter::CanHandleAndMaybeDispatchBeforeInputEvent() (this=0x7ffffffee738)
at /home/mirko/src/firefox/gecko2/editor/libeditor/EditorBase.h:856
#8 0x00007fffe2fe29ae in mozilla::TextEditor::PasteAsAction(int, bool, nsIPrincipal*) (this=0x7fffaa20d400, aClipboardType=1, aDispatchPasteEvent=true, aPrincipal=0x0) at /home/mirko/src/firefox/gecko2/editor/libeditor/TextEditorDataTransfer.cpp:586
#9 0x00007fffe2e95a15 in mozilla::PasteCommand::DoCommand(mozilla::Command, mozilla::TextEditor&, nsIPrincipal*) const (this=0x7fffba592f60, aCommand=mozilla::Command::Paste, aTextEditor=..., aPrincipal=0x0)
at /home/mirko/src/firefox/gecko2/editor/libeditor/EditorCommands.cpp:467
Attaching a review with a test to reproduce the issue. The issue is reproducible too, when ctrl-click selecting a table-cell (which is contenteditable or when document.designMode = "on") and deleting it.
|
Reporter | |
Comment 1•4 years ago
|
||
|
Assignee | |
Updated•4 years ago
|
|
|
Assignee | |
Updated•4 years ago
|
|
|
Assignee | |
Comment 3•4 years ago
|
||
Probably, there are 2 bugs. One is just we create wrong (reversed) range in TextFragmentData::GetNonCollapsedRangeInTexts(). I think that we should fix this first. Then, we should redesign selected table cell handling in editor. However, the latter is blocked by the complicated and stateful legacy API. Once we replace them with a simple API, we can fix the latter easier, and we can save the maintenance cost for the comm-central.
|
|
Reporter | |
Comment 4•4 years ago
|
||
However, the latter is blocked by the complicated and stateful legacy API.
Which API?
|
|
Assignee | |
Comment 5•4 years ago
|
||
(In reply to Mirko Brodesser (:mbrodesser) (offline until 25th of October 2020) from comment #4)
However, the latter is blocked by the complicated and stateful legacy API.
Which API?
Will be handled in bug 1671556.
|
|
Assignee | |
Updated•4 years ago
|
|
|
Assignee | |
Comment 6•4 years ago
|
||
This is a simple mistake. If the given range is collapsed, scanning text node
to before/after from collapsed range may create reversed range.
|
|
Assignee | |
Comment 7•4 years ago
|
||
So, the root cause of this assertion hit was, I forgot to add this path
when I implement the methods to compute target ranges. Although the other
browsers don't support multiple selection ranges, this patch adds WPTs
for the cases.
Depends on D94241
|
||
Comment 9•4 years ago
|
||
Backed out 4 changesets (Bug 1671556, Bug 1669479) for causing bustages in HTMLEditUtils.h
|
||
Comment 10•4 years ago
|
||
|
|
Assignee | |
Updated•4 years ago
|
|
||
Comment 11•4 years ago
|
||
| bugherder | ||
|
|
Assignee | |
Updated•4 years ago
|
|
|
||
Comment 12•4 years ago
|
||
|
||
Comment 14•4 years ago
|
||
| bugherder | ||
Description
•