Assertion failure: mIsPositioned || (!aStartBoundary.IsSet() && !aEndBoundary.IsSet() && !aRootNode) (Set all or none), at src/dom/base/nsRange.cpp:846
Categories
(Core :: DOM: Selection, defect)
Tracking
()
Tracking | Status | |
---|---|---|
firefox86 | --- | unaffected |
firefox87 | --- | unaffected |
firefox88 | --- | fix-optional |
People
(Reporter: tsmith, Unassigned)
References
(Blocks 2 open bugs)
Details
(4 keywords, Whiteboard: [bugmon:bisected,confirmed])
Attachments
(1 file)
1.04 KB,
text/html
|
Details |
Assertion failure: mIsPositioned || (!aStartBoundary.IsSet() && !aEndBoundary.IsSet() && !aRootNode) (Set all or none), at src/dom/base/nsRange.cpp:846
#0 0x7f26f276a530 in void nsRange::DoSetRange<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent>, nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> >(mozilla::RangeBoundaryBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > const&, mozilla::RangeBoundaryBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > const&, nsINode*, bool) src/dom/base/nsRange.cpp:844:3
#1 0x7f26f276b2c7 in nsRange::ParentChainChanged(nsIContent*) src/dom/base/nsRange.cpp:715:3
#2 0x7f26f25f12c8 in NotifyParentChainChanged /builds/worker/workspace/obj-build/dist/include/mozilla/dom/MutationObservers.h:127:7
#3 0x7f26f25f12c8 in mozilla::dom::Element::BindToTree(mozilla::dom::BindContext&, nsINode&) src/dom/base/Element.cpp:1742:3
#4 0x7f26f3f2f1a6 in nsGenericHTMLElement::BindToTree(mozilla::dom::BindContext&, nsINode&) src/dom/html/nsGenericHTMLElement.cpp:437:43
#5 0x7f26f273c9ef in nsINode::InsertChildBefore(nsIContent*, nsIContent*, bool) src/dom/base/nsINode.cpp:1550:23
#6 0x7f26f27419ee in nsINode::ReplaceOrInsertBefore(bool, nsINode*, nsINode*, mozilla::ErrorResult&) src/dom/base/nsINode.cpp:2721:14
#7 0x7f26f2bbf329 in InsertBefore src/dom/base/nsINode.h:1981:12
#8 0x7f26f2bbf329 in AppendChild src/dom/base/nsINode.h:1988:12
#9 0x7f26f2bbf329 in mozilla::dom::Node_Binding::appendChild(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/NodeBinding.cpp:992:60
#10 0x7f26f398588d in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3238:13
#11 0xa5248c32c95 (<unknown module>)
Reporter | ||
Comment 1•4 years ago
|
||
A Pernosco session is available here: https://pernos.co/debug/JYM835Xm8l0aTTXoQN-95Q/index.html
Comment 2•4 years ago
|
||
Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210309094921-b332567cbbca.
The bug appears to have been introduced in the following build range:
Start: bfb3aee94a88794cfd51b5a80bf162357b2606cf (20200529071202)
End: 1393662c8ab88f30c115e7a61192f5a050d81da7 (20200529081729)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=bfb3aee94a88794cfd51b5a80bf162357b2606cf&tochange=1393662c8ab88f30c115e7a61192f5a050d81da7
Comment 3•4 years ago
|
||
Is there a scenario involving DevTools linked to this bug report?
If it's just about loading the attached test case, then I think the regression window might be incorrect.
None of the files touched in Bug 1637687 are loaded unless you open DevTools.
Are we sure about the bisection performed here?
Reporter | ||
Comment 4•4 years ago
|
||
Yep that looks wrong, CC'ing Jason.
Fuzzers first hit this fuzzing m-c 20210307-74e3d611be8f.
Updated•4 years ago
|
Comment 5•4 years ago
|
||
The bisection is indeed wrong. I've run multiple bisections, each of which has resulted in a different range. It appears that issues with testcase stability across the build timeline are responsible. It is unlikely that we will be able to get an accurate bisection for this issue.
Comment 6•4 years ago
|
||
Thanks for checking! Removing Bug 1637687 from the regressed by field.
Updated•4 years ago
|
Updated•4 years ago
|
Description
•