1717007 - Crash in [@ mozilla::DeleteNodeTransaction::DoTransaction]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Francois Guerraz]

Crash report: https://crash-stats.mozilla.org/report/index/b716c5a3-1f64-40af-a299-044d30210617

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(!mEditorBase->IsTextEditor() || !mContentToDelete->IsText())

Top 10 frames of crashing thread:

0 libxul.so mozilla::DeleteNodeTransaction::DoTransaction editor/libeditor/DeleteNodeTransaction.cpp:84
1 libxul.so mozilla::EditAggregateTransaction::DoTransaction editor/libeditor/EditAggregateTransaction.cpp:38
2 libxul.so mozilla::DeleteRangeTransaction::DoTransaction editor/libeditor/DeleteRangeTransaction.cpp:99
3 libxul.so mozilla::EditAggregateTransaction::DoTransaction editor/libeditor/EditAggregateTransaction.cpp:38
4 libxul.so mozilla::TransactionManager::BeginTransaction editor/txmgr/TransactionManager.cpp:687
5 libxul.so mozilla::TransactionManager::DoTransaction editor/txmgr/TransactionManager.cpp:72
6 libxul.so mozilla::EditorBase::DoTransactionInternal editor/libeditor/EditorBase.cpp:926
7 libxul.so mozilla::EditorBase::DeleteRangesWithTransaction editor/libeditor/EditorBase.cpp:4983
8 libxul.so mozilla::EditorBase::DeleteSelectionWithTransaction editor/libeditor/EditorBase.cpp:4866
9 libxul.so mozilla::TextEditor::HandleDeleteSelectionInternal editor/libeditor/TextEditSubActionHandler.cpp:643

Reproducible when using the AWS console, creating a load balancer, setting a name for a new security group

Comment 1

[Francois Guerraz]

Verified with an empty profile,

tracked to https://hg.mozilla.org/integration/autoland/rev/2f69dc403886dd1c721cec815b00ec5bfca4b393 with mozregression

Comment 2

[Kagami Rosylight [:saschanaz] (they/them)]

Reproducible when using the AWS console, creating a load balancer, setting a name for a new security group

Could you try getting a minimal repro, since I have no AWS account? Otherwise I will investigate next week.

Comment 3

[Jeff Muizelaar [:jrmuizel]]

I've been seeing this as well. I don't have steps to reproduce but I encountered while editing text in a google doc comment.

Comment 4

[Jeff Muizelaar [:jrmuizel]]

This is the 2nd highest crash on https://crash-stats.mozilla.org/topcrashers/?product=Firefox&version=91.0a1&days=1 so we should probably back it out and respin the nightly.

Comment 5

[Kagami Rosylight [:saschanaz] (they/them)]

Agreed. I'm off today actually, could you ping the relevant people to do that?

Comment 6

[Jeff Muizelaar [:jrmuizel]]

Yep, I can do that. Is backing out https://hg.mozilla.org/integration/autoland/rev/2f69dc403886dd1c721cec815b00ec5bfca4b393 sufficient or will https://hg.mozilla.org/integration/autoland/rev/e96a8ebb3e32 need to come out as well?

Comment 7

[yasharjit]

I can reproduce this crash by selecting the text in any text field and by deleting the selected text by pressing backspace. If you do it in the URL bar then the whole browser crashes and if you do this in any other text field on any website then the tab crashes.

Comment 8

[Kagami Rosylight [:saschanaz] (they/them)]

(In reply to Jeff Muizelaar [:jrmuizel] from comment #6)

Yep, I can do that. Is backing out https://hg.mozilla.org/integration/autoland/rev/2f69dc403886dd1c721cec815b00ec5bfca4b393 sufficient or will https://hg.mozilla.org/integration/autoland/rev/e96a8ebb3e32 need to come out as well?

That one should be okay as is. Thanks!

Comment 9

[Kagami Rosylight [:saschanaz] (they/them)]

(In reply to yasharjit from comment #7)

I can reproduce this crash by selecting the text in any text field and by deleting the selected text by pressing backspace. If you do it in the URL bar then the whole browser crashes and if you do this in any other text field on any website then the tab crashes.

Thanks! Easy and scary repro 😱

Comment 10

[Ryan VanderMeulen [:RyanVM]]

The regressing bugs were backed out and Nightly respins are in progress.

Comment 11

[Pascal Chevrel:pascalc]

Fixed by backout