1704381 - Switching text direction removes the entire text

Status: RESOLVED FIXED

(Core :: DOM: Editor, defect, P1)

Description

[Itiel]

STR:

1. Open https://meta.wikimedia.org/wiki/Special:Translate?group=agg-2017_Wikimedia_movement_strategy_process&uselang=en&language=he&filter=%21translated&action=translate
2. In the textarea where the placeholder's text is "Your translation", enter any text
3. Switch writing direction (Ctrl+Shift+X on Windows)

AR:
The entire typed text is removed.

ER:
The text is retained and the text direction is switched.

Comment 1

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Thank you for the regression report! I'll take a look ASAP.

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

This is what it occurs after pressing Ctrl + Shift + X.

[Child 10764, Main Thread] WARNING: NS_ENSURE_TRUE(mPresShell) failed: file m:/src/layout/generic/nsFrameSelection.cpp:1591
[Child 10764, Main Thread] WARNING: Editor was destroyed during an edit action being handled: file m:/fx64-dbg/dist/include\mozilla/EditorBase.h:865
[Child 10764, Main Thread] WARNING: '!editActionData.CanHandle()', file m:/src/editor/libeditor/EditorBase.cpp:314
[Child 10764, Main Thread] WARNING: EditorBase::Init() failed: file m:/src/editor/libeditor/TextEditor.cpp:129
[Child 10764, Main Thread] WARNING: TextEditor::Init() failed: file m:/src/dom/html/TextControlState.cpp:1807
[Child 10764, Main Thread] WARNING: Editor was destroyed during an edit action being handled: file m:/fx64-dbg/dist/include\mozilla/EditorBase.h:865
[Child 10764, Main Thread] WARNING: '!editActionData.CanHandle()', file m:/fx64-dbg/dist/include\mozilla/TextEditor.h:311
[Child 10764, Main Thread] WARNING: Failed to get value: 'NS_SUCCEEDED(rv)', file m:/src/dom/html/TextControlState.cpp:2535
[Child 10764, Main Thread] WARNING: Editor was destroyed during an edit action being handled: file m:/fx64-dbg/dist/include\mozilla/EditorBase.h:865
[Child 10764, Main Thread] WARNING: '!editActionData.CanHandle()', file m:/src/editor/libeditor/EditorBase.cpp:314
[Child 10764, Main Thread] WARNING: EditorBase::Init() failed: file m:/src/editor/libeditor/TextEditor.cpp:129
[Child 10764, Main Thread] WARNING: TextEditor::Init() failed: file m:/src/dom/html/TextControlState.cpp:1807
[Child 10764, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file m:/src/layout/forms/nsTextControlFrame.cpp:306

When hitting first warning in CanHandle, I got this stack:

[Child 17848, Main Thread] ###!!! ASSERTION: Editor was destroyed during an edit action being handled: 'false', file m:/fx64-dbg/dist/include\mozilla/EditorBase.h:866
#01: mozilla::TextEditor::Init (m:\src\editor\libeditor\TextEditor.cpp:128)
#02: mozilla::TextControlState::PrepareEditor (m:\src\dom\html\TextControlState.cpp:1804)
#03: mozilla::PrepareEditorEvent::Run (m:\src\dom\html\TextControlState.cpp:1581)
#04: nsContentUtils::RemoveScriptBlocker (m:\src\dom\base\nsContentUtils.cpp:5565)
#05: mozilla::PresShell::DoFlushPendingNotifications (m:\src\layout\base\PresShell.cpp:4212)
#06: mozilla::dom::Document::FlushPendingNotifications (m:\src\dom\base\Document.cpp:10555)
#07: nsIContent::GetPrimaryFrame (m:\src\dom\base\Element.cpp:250)
#08: mozilla::dom::Element::GetScrollFrame (m:\src\dom\base\Element.cpp:620)
#09: mozilla::dom::Element::ScrollHeight (m:\src\dom\base\Element.cpp:924)
#10: mozilla::dom::Element_Binding::get_scrollHeight (m:\fx64-dbg\dom\bindings\ElementBinding.cpp:3247)
#11: mozilla::dom::binding_detail::GenericGetter<mozilla::dom::binding_detail::NormalThisPolicy,mozilla::dom::binding_detail::ThrowExceptions> (m:\src\dom\bindings\BindingUtils.cpp:3113)
#12: CallJSNative (m:\src\js\src\vm\Interpreter.cpp:435)
#13: js::InternalCallOrConstruct (m:\src\js\src\vm\Interpreter.cpp:520)
#14: InternalCall (m:\src\js\src\vm\Interpreter.cpp:580)
#15: js::Call (m:\src\js\src\vm\Interpreter.cpp:597)
#16: js::CallGetter (m:\src\js\src\vm\Interpreter.cpp:721)
#17: GetExistingProperty<js::CanGC> (m:\src\js\src\vm\NativeObject.cpp:2197)
#18: NativeGetPropertyInline<js::CanGC> (m:\src\js\src\vm\NativeObject.cpp:2341)
#19: js::NativeGetProperty (m:\src\js\src\vm\NativeObject.cpp:2371)
#20: js::GetProperty (m:\src\js\src\vm\ObjectOperations-inl.h:124)
#21: js::GetProperty (m:\src\js\src\vm\Interpreter.cpp:4559)
#22: Interpret (m:\src\js\src\vm\Interpreter.cpp:2935)
#23: js::RunScript (m:\src\js\src\vm\Interpreter.cpp:405)
#24: js::InternalCallOrConstruct (m:\src\js\src\vm\Interpreter.cpp:552)
#25: InternalCall (m:\src\js\src\vm\Interpreter.cpp:580)
#26: js::Call (m:\src\js\src\vm\Interpreter.cpp:597)
#27: JS::Call (m:\src\js\src\jsapi.cpp:2821)
#28: mozilla::dom::EventListener::HandleEvent (m:\fx64-dbg\dom\bindings\EventListenerBinding.cpp:58)
#29: mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget *> (m:\fx64-dbg\dist\include\mozilla\dom\EventListenerBinding.h:65)
#30: mozilla::EventListenerManager::HandleEventSubType (m:\src\dom\events\EventListenerManager.cpp:1106)
#31: mozilla::EventListenerManager::HandleEventInternal (m:\src\dom\events\EventListenerManager.cpp:1303)
#32: mozilla::EventTargetChainItem::HandleEvent (m:\src\dom\events\EventDispatcher.cpp:357)
#33: mozilla::EventTargetChainItem::HandleEventTargetChain (m:\src\dom\events\EventDispatcher.cpp:558)
#34: mozilla::EventDispatcher::Dispatch (m:\src\dom\events\EventDispatcher.cpp:1099)
#35: nsContentUtils::DispatchInputEvent (m:\src\dom\base\nsContentUtils.cpp:4404)
#36: mozilla::EditorBase::DispatchInputEvent (m:\src\editor\libeditor\EditorBase.cpp:1811)
#37: mozilla::EditorBase::ToggleTextDirectionAsAction (m:\src\editor\libeditor\EditorBase.cpp:4441)
#38: mozilla::SwitchTextDirectionCommand::DoCommand (m:\src\editor\libeditor\EditorCommands.cpp:553)

So, looks like that input event listener retrieves scrollHeight and it causes flushing layout during handling the edit action. Then, initializing the editor is nested into the first edit action (switching the text direction).

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Bug 1704381 - part 1: Make `EditorBase::Init` set edit action to `EditAction::eInitializing` r=m_kato!

I forgot to do this in EditorBase::Init. Therefore, it fails at synchronous
reinitializing during an edit action.

Comment 4

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Bug 1704381 - part 2: Make `AutoEditActionDataSetter` not store whether editor is destroyed after handling its edit action r=m_kato!

Currently, its mEditorWasDestroyed is set to true even while input event
is being dispatched, i.e., even when it finished everything for the edit action.
However, the flag should be only for blocking unexpected cause which is caused
by mutation event listeners or something other unexpected event listeners
which shouldn't be run while editor is handling an edit action.

Therefore, this patch makes it store "handled" state which is marked before
notifying editor observers and dispatching input event and the flag won't
be set to true after it's marked as "handled".

Depends on D111579

Comment 5

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Bug 1704381 - part 3: Add automated test r=m_kato!

Depends on D111580

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1691051

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f7aede373d8e
part 1: Make `EditorBase::Init` set edit action to `EditAction::eInitializing` r=m_kato
https://hg.mozilla.org/integration/autoland/rev/ab67afeb3b55
part 2: Make `AutoEditActionDataSetter` not store whether editor is destroyed after handling its edit action r=m_kato
https://hg.mozilla.org/integration/autoland/rev/67318cc7d1cc
part 3: Add automated test r=m_kato

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/f7aede373d8e
https://hg.mozilla.org/mozilla-central/rev/ab67afeb3b55
https://hg.mozilla.org/mozilla-central/rev/67318cc7d1cc

Comment 9

[Amir Aharoni]

I confirm it's fixed in Nightly 89.0a1 ‏(2021-04-13). Thank you!