Closed Bug 1669479 Opened 1 year ago Closed 1 year ago

Assertion failure: mStart.EqualsOrIsBefore(mEnd), at EditorDOMPoint.h:1039 when replacing/deleting table cells

Categories

(Core :: DOM: Editor, defect, P3)

defect

Tracking

()

RESOLVED FIXED
84 Branch
Tracking Status
firefox84 --- fixed

People

(Reporter: mbrodesser, Assigned: masayuki)

References

Details

Attachments

(3 files)

(gdb) bt
#0  0x00007fffe2ff927d in mozilla::EditorDOMRangeBase<mozilla::EditorDOMPointBase<RefPtr<mozilla::dom::Text>, nsIContent*> >::EditorDOMRangeBase<mozilla::EditorDOMPointBase<RefPtr<mozilla::dom::Text>, nsIContent*>, mozilla::EditorDOMPointBase<RefPtr<mozilla::dom::Text>, nsIContent*> >(mozilla::EditorDOMPointBase<RefPtr<mozilla::dom::Text>, nsIContent*> const&, mozilla::EditorDOMPointBase<RefPtr<mozilla::dom::Text>, nsIContent*> const&) (this=0x7ffffffed8b8, aStart=..., aEnd=...)
    at /home/mirko/src/firefox/gecko2/obj-x86_64-pc-linux-gnu-debug/dist/include/mozilla/EditorDOMPoint.h:1038
#1  0x00007fffe2feeb4d in mozilla::WSRunScanner::TextFragmentData::GetNonCollapsedRangeInTexts(mozilla::EditorDOMRangeBase<mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > > const&) const (this=0x7ffffffed8f8, aRange=...)
    at /home/mirko/src/firefox/gecko2/editor/libeditor/WSRunObject.cpp:1715
#2  0x00007fffe2ff2d45 in mozilla::WSRunScanner::GetRangeContainingInvisibleWhiteSpacesAtRangeBoundaries(mozilla::HTMLEditor const&, mozilla::EditorDOMRangeBase<mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > > const&) (aHTMLEditor=..., aRange=...)
    at /home/mirko/src/firefox/gecko2/editor/libeditor/WSRunObject.cpp:3495
#3  0x00007fffe2eeb1eb in mozilla::HTMLEditor::AutoDeleteRangesHandler::ComputeRangesToDeleteNonCollapsedRanges(mozilla::HTMLEditor const&, short, mozilla::AutoRangeArray&, mozilla::HTMLEditor::AutoDeleteRangesHandler::SelectionWasCollapsed) const (this=0x7ffffffee408, aHTMLEditor=..., aDirectionAndAmount=0, aRangesToDelete=..., aSelectionWasCollapsed=mozilla::HTMLEditor::AutoDeleteRangesHandler::SelectionWasCollapsed::No) at /home/mirko/src/firefox/gecko2/editor/libeditor/HTMLEditSubActionHandler.cpp:4999
#4  0x00007fffe2ee7266 in mozilla::HTMLEditor::AutoDeleteRangesHandler::ComputeRangesToDelete(mozilla::HTMLEditor const&, short, mozilla::AutoRangeArray&) (this=0x7ffffffee408, aHTMLEditor=..., aDirectionAndAmount=0, aRangesToDelete=...)
    at /home/mirko/src/firefox/gecko2/editor/libeditor/HTMLEditSubActionHandler.cpp:3575
#5  0x00007fffe2ee5df4 in mozilla::HTMLEditor::ComputeTargetRanges(short, mozilla::AutoRangeArray&) (this=0x7fffaa20d400, aDirectionAndAmount=0, aRangesToDelete=...) at /home/mirko/src/firefox/gecko2/editor/libeditor/HTMLEditSubActionHandler.cpp:3278
#6  0x00007fffe2e89e73 in mozilla::EditorBase::AutoEditActionDataSetter::MaybeDispatchBeforeInputEvent(short) (this=0x7ffffffee738, aDeleteDirectionAndAmount=0) at /home/mirko/src/firefox/gecko2/editor/libeditor/EditorBase.cpp:5358
#7  0x00007fffe2eaa6f2 in mozilla::EditorBase::AutoEditActionDataSetter::CanHandleAndMaybeDispatchBeforeInputEvent() (this=0x7ffffffee738)
    at /home/mirko/src/firefox/gecko2/editor/libeditor/EditorBase.h:856
#8  0x00007fffe2fe29ae in mozilla::TextEditor::PasteAsAction(int, bool, nsIPrincipal*) (this=0x7fffaa20d400, aClipboardType=1, aDispatchPasteEvent=true, aPrincipal=0x0) at /home/mirko/src/firefox/gecko2/editor/libeditor/TextEditorDataTransfer.cpp:586
#9  0x00007fffe2e95a15 in mozilla::PasteCommand::DoCommand(mozilla::Command, mozilla::TextEditor&, nsIPrincipal*) const (this=0x7fffba592f60, aCommand=mozilla::Command::Paste, aTextEditor=..., aPrincipal=0x0)
    at /home/mirko/src/firefox/gecko2/editor/libeditor/EditorCommands.cpp:467

Attaching a review with a test to reproduce the issue. The issue is reproducible too, when ctrl-click selecting a table-cell (which is contenteditable or when document.designMode = "on") and deleting it.

I'll take a look in the next week.

Flags: needinfo?(masayuki)
Assignee: nobody → masayuki
Severity: -- → S3
Status: NEW → ASSIGNED
Flags: needinfo?(masayuki)
Priority: -- → P3
Blocks: 1665530
OS: Unspecified → All
Hardware: Unspecified → All

Probably, there are 2 bugs. One is just we create wrong (reversed) range in TextFragmentData::GetNonCollapsedRangeInTexts(). I think that we should fix this first. Then, we should redesign selected table cell handling in editor. However, the latter is blocked by the complicated and stateful legacy API. Once we replace them with a simple API, we can fix the latter easier, and we can save the maintenance cost for the comm-central.

However, the latter is blocked by the complicated and stateful legacy API.

Which API?

(In reply to Mirko Brodesser (:mbrodesser) (offline until 25th of October 2020) from comment #4)

However, the latter is blocked by the complicated and stateful legacy API.

Which API?

Will be handled in bug 1671556.

This is a simple mistake. If the given range is collapsed, scanning text node
to before/after from collapsed range may create reversed range.

So, the root cause of this assertion hit was, I forgot to add this path
when I implement the methods to compute target ranges. Although the other
browsers don't support multiple selection ranges, this patch adds WPTs
for the cases.

Depends on D94241

Pushed by masayuki@d-toybox.com:
https://hg.mozilla.org/integration/autoland/rev/e94d989b8cb4
part 1: Make `WSRunScanner::TextFragmentData::GetNonCollapsedRangeInTexts()` stop searching text node when given range is collapsed r=m_kato

Backed out 4 changesets (Bug 1671556, Bug 1669479) for causing bustages in HTMLEditUtils.h

Flags: needinfo?(masayuki)
Pushed by masayuki@d-toybox.com:
https://hg.mozilla.org/integration/autoland/rev/745709c57616
part 1: Make `WSRunScanner::TextFragmentData::GetNonCollapsedRangeInTexts()` stop searching text node when given range is collapsed r=m_kato
Flags: needinfo?(masayuki)
Pushed by masayuki@d-toybox.com:
https://hg.mozilla.org/integration/autoland/rev/3f5329be8e58
part 2: Make `HTMLEditor::ComputeTargetRanges()` handle table cell selection mode with new utilities r=m_kato
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/26297 for changes under testing/web-platform/tests
Status: ASSIGNED → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → 84 Branch
Upstream PR merged by moz-wptsync-bot
You need to log in before you can comment on or make changes to this bug.