1830757 - Assertion failure: !mMutationGuard.Mutated(0) (Don't mutate the DOM while using a ShadowIncludingTreeIterator) triggers when viewing e-mail

Status: RESOLVED FIXED

(Thunderbird :: General, defect)

Description

[BB]

Attachment: crash-mail.eml

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 Edg/112.0.1722.64

Steps to reproduce:

When viewing the attached e-mail message in a debug build of Thunderbird, this assertion is triggered, here shown with the call stack:

Assertion failure: !mMutationGuard.Mutated(0) (Don't mutate the DOM while using a ShadowIncludingTreeIterator), at C:/mozilla-source/mozilla-central/obj-x86_64-pc-mingw32/dist/include\mozilla/dom/ShadowIncludingTreeIterator.h:39
#01: nsTreeSanitizer::RemoveConditionalCSSFromSubtree (C:\mozilla-source\mozilla-central\dom\base\nsTreeSanitizer.cpp:1826)
#02: nsParserUtils::RemoveConditionalCSS (C:\mozilla-source\mozilla-central\parser\html\nsParserUtils.cpp:79)
#03: MimeInlineTextHTMLParsed_parse_eof (C:\mozilla-source\mozilla-central\comm\mailnews\mime\src\mimeTextHTMLParsed.cpp:126)
#04: MimeMultipartAlternative_flush_children (C:\mozilla-source\mozilla-central\comm\mailnews\mime\src\mimemalt.cpp:237)

TB calls nsParserUtils::RemoveConditionalCSS() and that triggers the assert here:

https://searchfox.org/comm-central/rev/6d66ffe926d22f3a1568eccd4aa73472ec3e3ad4/mozilla/dom/base/ShadowIncludingTreeIterator.h#38

The HTML of the e-mail contains various media queries which apparent are being removed.

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

I'm not sure this is a TB issue. nsTreeSanitizer::RemoveConditionalCSSFromSubtree should be able to modify the tree, but bug 1780361 changed that, I think.

Comment 2

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 1830757 - Prevent node removal during iteration in conditional css sanitization. r=smaug

When the whole block is sanitized away, we remove the text node
altogether, triggering the assert. While it's not worrisome in this
case, the right thing to do is not mutating the DOM during iteration.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/88690804eb7d
Prevent node removal during iteration in conditional css sanitization. r=smaug

Comment 4

[BB]

Please move the bug back to DOM:Core.

Comment 5

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/88690804eb7d