Open Bug 1697088 Opened 4 years ago Updated 4 years ago

Assertion failure: mIsPositioned || (!aStartBoundary.IsSet() && !aEndBoundary.IsSet() && !aRootNode) (Set all or none), at src/dom/base/nsRange.cpp:846

Categories

(Core :: DOM: Selection, defect)

defect

Tracking

()

Tracking Status
firefox86 --- unaffected
firefox87 --- unaffected
firefox88 --- fix-optional

People

(Reporter: tsmith, Unassigned)

References

(Blocks 2 open bugs)

Details

(4 keywords, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(1 file)

Attached file testcase.html

Assertion failure: mIsPositioned || (!aStartBoundary.IsSet() && !aEndBoundary.IsSet() && !aRootNode) (Set all or none), at src/dom/base/nsRange.cpp:846

#0 0x7f26f276a530 in void nsRange::DoSetRange<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent>, nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> >(mozilla::RangeBoundaryBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > const&, mozilla::RangeBoundaryBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > const&, nsINode*, bool) src/dom/base/nsRange.cpp:844:3
#1 0x7f26f276b2c7 in nsRange::ParentChainChanged(nsIContent*) src/dom/base/nsRange.cpp:715:3
#2 0x7f26f25f12c8 in NotifyParentChainChanged /builds/worker/workspace/obj-build/dist/include/mozilla/dom/MutationObservers.h:127:7
#3 0x7f26f25f12c8 in mozilla::dom::Element::BindToTree(mozilla::dom::BindContext&, nsINode&) src/dom/base/Element.cpp:1742:3
#4 0x7f26f3f2f1a6 in nsGenericHTMLElement::BindToTree(mozilla::dom::BindContext&, nsINode&) src/dom/html/nsGenericHTMLElement.cpp:437:43
#5 0x7f26f273c9ef in nsINode::InsertChildBefore(nsIContent*, nsIContent*, bool) src/dom/base/nsINode.cpp:1550:23
#6 0x7f26f27419ee in nsINode::ReplaceOrInsertBefore(bool, nsINode*, nsINode*, mozilla::ErrorResult&) src/dom/base/nsINode.cpp:2721:14
#7 0x7f26f2bbf329 in InsertBefore src/dom/base/nsINode.h:1981:12
#8 0x7f26f2bbf329 in AppendChild src/dom/base/nsINode.h:1988:12
#9 0x7f26f2bbf329 in mozilla::dom::Node_Binding::appendChild(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/NodeBinding.cpp:992:60
#10 0x7f26f398588d in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3238:13
#11 0xa5248c32c95  (<unknown module>)
Flags: in-testsuite?

A Pernosco session is available here: https://pernos.co/debug/JYM835Xm8l0aTTXoQN-95Q/index.html

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210309094921-b332567cbbca.
The bug appears to have been introduced in the following build range:

Start: bfb3aee94a88794cfd51b5a80bf162357b2606cf (20200529071202)
End: 1393662c8ab88f30c115e7a61192f5a050d81da7 (20200529081729)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=bfb3aee94a88794cfd51b5a80bf162357b2606cf&tochange=1393662c8ab88f30c115e7a61192f5a050d81da7

Whiteboard: [bugmon:bisected,confirmed]
Flags: needinfo?(jdescottes)
Regressed by: 1637687

Is there a scenario involving DevTools linked to this bug report?
If it's just about loading the attached test case, then I think the regression window might be incorrect.
None of the files touched in Bug 1637687 are loaded unless you open DevTools.

Are we sure about the bisection performed here?

Flags: needinfo?(jdescottes) → needinfo?(twsmith)

Yep that looks wrong, CC'ing Jason.

Fuzzers first hit this fuzzing m-c 20210307-74e3d611be8f.

Flags: needinfo?(twsmith) → needinfo?(jkratzer)

The bisection is indeed wrong. I've run multiple bisections, each of which has resulted in a different range. It appears that issues with testcase stability across the build timeline are responsible. It is unlikely that we will be able to get an accurate bisection for this issue.

Flags: needinfo?(jkratzer)

Thanks for checking! Removing Bug 1637687 from the regressed by field.

No longer regressed by: 1637687
Severity: -- → S3
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: