1716714 - Crash in [@ mozilla::TextEditor::SelectEntireDocument] [@ mozilla::TextEditor::SetTextAsSubAction] [@ mozilla::TextEditor::SetTextWithoutTransaction]

Status: RESOLVED DUPLICATE of bug 1713334

(Core :: DOM: Editor, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

22 affected installations for [@ mozilla::TextEditor::SelectEntireDocument] as the most frequent signature.

Crash report: https://crash-stats.mozilla.org/report/index/4d9b22a3-5c70-4a7f-831f-bc5af0210616

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll mozilla::TextEditor::SelectEntireDocument editor/libeditor/TextEditor.cpp:574
1 xul.dll mozilla::TextEditor::SetTextAsSubAction editor/libeditor/TextEditor.cpp:314
2 xul.dll mozilla::EditorBase::ReplaceTextAsAction editor/libeditor/EditorBase.cpp:5359
3 xul.dll mozilla::TextControlState::SetValueWithTextEditor dom/html/TextControlState.cpp:2740
4 xul.dll mozilla::TextControlState::SetValue dom/html/TextControlState.cpp:2654
5 xul.dll mozilla::dom::HTMLInputElement::SetValueInternal dom/html/HTMLInputElement.cpp:2656
6 xul.dll mozilla::dom::HTMLInputElement::SetUserInput dom/html/HTMLInputElement.cpp:2246
7 xul.dll nsFormFillController::SetTextValue toolkit/components/satchel/nsFormFillController.cpp:535
8 xul.dll nsAutoCompleteController::SetValueOfInputTo toolkit/components/autocomplete/nsAutoCompleteController.cpp:67
9 xul.dll nsAutoCompleteController::EnterMatch toolkit/components/autocomplete/nsAutoCompleteController.cpp:1278

Comment 1

[Kagami Rosylight [:saschanaz] (they/them)]

Note for myself: It seems some chrome code calls .textContent setter directly on an editor root node. No, it was a test which is expected... 🤔

https://treeherder.mozilla.org/jobs?repo=try&revision=719513a14a376dcb49656e5c7980a0470255912f&selectedTaskRun=GRbVMfciTSaMQw1DQ8_Jqw.0

Comment 2

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Should [@ mozilla::EditorBase::SetTextNodeWithoutTransaction] be tracked in a different bug?

Comment 3

[Kagami Rosylight [:saschanaz] (they/them)]

I think it belongs to here. 👍

Comment 4

[Kagami Rosylight [:saschanaz] (they/them)]

Attachment: Bug 1716714 - Temporarily convert text node assertion as diagnostic r=masayuki

Comment 5

[Kagami Rosylight [:saschanaz] (they/them)]

Attachment: Bug 1716714 - Insert text node as the first child r=masayuki

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2f69dc403886
Temporarily convert text node assertion as diagnostic r=masayuki

Comment 7

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/2f69dc403886

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e96a8ebb3e32
Insert text node as the first child r=masayuki

Comment 9

[Ryan VanderMeulen [:RyanVM]]

(In reply to Natalia Csoregi [:nataliaCs] from comment #7)

https://hg.mozilla.org/mozilla-central/rev/2f69dc403886

Backed out for causing bug 1717007.
https://hg.mozilla.org/mozilla-central/rev/f5a661c93a88561340ecfb9ef7e627aaa6183be9

Comment 10

[Ryan VanderMeulen [:RyanVM]]

(In reply to Pulsebot from comment #8)

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e96a8ebb3e32
Insert text node as the first child r=masayuki

Backed out as part of the bigger set of backouts from this bug and bug 1713334.
https://hg.mozilla.org/integration/autoland/rev/cc47cecd042cfa2ee87ea7dace62e8bfaa6a381f

Comment 11

[Kagami Rosylight [:saschanaz] (they/them)]

Fixed in bug 1713334.

Comment 12

[Mathew Hodson]

Fixed by backout.
https://hg.mozilla.org/mozilla-central/rev/0c973c77d0e21f0281c1b1fc1324161592842f96