1800043 - macOS Crash in [@ mozilla::EditorDOMPointBase<T>::ContainerAs<T>]

Status: RESOLVED FIXED

(Core :: DOM: Editor, defect, P1)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

8 crashes from 6 installations on macOS, oldest reported version is Firefox 108.0a1 20221030090504.

Masayuki, are you aware of a change which would explain this?

Crash report: https://crash-stats.mozilla.org/report/index/c7e6a5ec-c3a3-4b7c-8b97-a34fd0221110

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(ContentNodeType::FromNode(mParent))

Top 10 frames of crashing thread:

0  XUL  mozilla::EditorDOMPointBase<nsINode*, nsIContent*>::ContainerAs<mozilla::dom::Text> const  editor/libeditor/EditorDOMPoint.h:214
0  XUL  mozilla::EditorDOMPointBase<nsINode*, nsIContent*>::Char const  editor/libeditor/EditorDOMPoint.h:390
1  XUL  mozilla::EditorDOMPointBase<nsINode*, nsIContent*>::IsCharASCIISpaceOrNBSP const  editor/libeditor/EditorDOMPoint.h:397
1  XUL  mozilla::DeleteRangeTransaction::MaybeExtendDeletingRangeWithSurroundingWhitespace const  editor/libeditor/DeleteRangeTransaction.cpp:76
1  XUL  mozilla::DeleteRangeTransaction::DoTransaction  editor/libeditor/DeleteRangeTransaction.cpp:125
2  XUL  mozilla::EditAggregateTransaction::DoTransaction  editor/libeditor/EditAggregateTransaction.cpp:38
3  XUL  mozilla::TransactionItem::DoTransaction  editor/txmgr/TransactionItem.cpp:83
3  XUL  mozilla::TransactionManager::BeginTransaction  editor/txmgr/TransactionManager.cpp:422
4  XUL  mozilla::TransactionManager::DoTransaction  editor/txmgr/TransactionManager.cpp:74
5  XUL  mozilla::EditorBase::DoTransactionInternal  editor/libeditor/EditorBase.cpp:908

Comment 1

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Jan: Could you take a look? This is obviously a regression of bug 1783641.

Comment 2

[Hsin-Yi Tsai (she/her) [:hsinyi]]

New crash regression - let's by default give it a high severity & priority.

Comment 3

[Jan Jaeschke [:jjaschke]]

Attachment: Bug 1800043: Fixed condition to determine end of selected string. r=masayuki

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6fab61424d92
Fixed condition to determine end of selected string. r=masayuki

Comment 5

[Jan Jaeschke [:jjaschke]]

Comment on attachment 9303038 [details]
Bug 1800043: Fixed condition to determine end of selected string. r=masayuki

Beta/Release Uplift Approval Request

• User impact if declined: Segfaults occur when macOS users double click the last word in a div contenteditable and press delete, if the content ends with an empty <span> element:

<div contenteditable><p>abc def<span></span></p></div>

(double click on "def" + pressing delete crashes)

• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce: (see above. A wpt is included in the patch that tests this)
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The faulty condition that led to segfaults has been fixed. A wpt test case has been added that reproduced the crash and verifies that it is resolved now.
• String changes made/needed:
• Is Android affected?: No

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Beta (v107) is not affected - bug 1783641 only landed for Nightly (v108). Can the uplift request be ignored?

Comment 7

[Jan Jaeschke [:jjaschke]]

Ah, my bad. Yes, can be ignored.

Comment 8

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/6fab61424d92