Open Bug 1838346 Opened 2 years ago Updated 2 years ago

test_bug300691-1.html fails without weird stylesheet load event scheduling / parser-blocking behavior.

Categories

(Core :: DOM: Editor, defect)

Product:
Core
Component:
DOM: Editor
Type:
defect

Tracking

()

People

(Reporter: emilio, Unassigned)

References

Details

If to current central you apply the following patch:

diff --git a/dom/html/test/test_bug300691-1.html b/dom/html/test/test_bug300691-1.html
index 66cc2a1c7c8ef..b05e3f5d658b0 100644
--- a/dom/html/test/test_bug300691-1.html
+++ b/dom/html/test/test_bug300691-1.html
@@ -7,7 +7,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=300691
   <title>Test for Bug 300691</title>
   <script src="/tests/SimpleTest/SimpleTest.js"></script>        
   <script src="/tests/SimpleTest/EventUtils.js"></script>        
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+  <!-- <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> -->
+  <link rel="stylesheet" type="text/css" href="data:text/css," />
 </head>
 <body>
 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=300691">Mozilla Bug 300691</a>

The test still passes. If you then remove the empty stylesheet, it fails like so:

0:07.16 FAIL Typed 'Test' after three left-arrows starting from end - got "Testabcdefgh", expected "abcdeTestfgh"
    SimpleTest.is@SimpleTest/SimpleTest.js:507:14
    valueIs@dom/html/test/test_bug300691-1.html:26:5
    @dom/html/test/test_bug300691-1.html:75:8
 0:07.16 PASS Typing 'Test' shouldn't affect default value
 0:07.16 FAIL Backspaced twice after two right-arrows starting from end of typing - got "Testcdefgh", expected "abcdeTesth"
    SimpleTest.is@SimpleTest/SimpleTest.js:507:14
    valueIs@dom/html/test/test_bug300691-1.html:26:5
    @dom/html/test/test_bug300691-1.html:83:8
 0:07.16 PASS Deleting shouldn't affect default value
 0:07.16 FAIL Appending textnode shouldn't affect value in edited textarea - got "Testcdefgh", expected "abcdeTesth"
    SimpleTest.is@SimpleTest/SimpleTest.js:507:14
    valueIs@dom/html/test/test_bug300691-1.html:26:5
    @dom/html/test/test_bug300691-1.html:88:8
 0:07.16 PASS Appended textnode 3
 0:07.16 FAIL Modifying textnode text shouldn't affect value in edited textarea - got "Testcdefgh", expected "abcdeTesth"
    SimpleTest.is@SimpleTest/SimpleTest.js:507:14
    valueIs@dom/html/test/test_bug300691-1.html:26:5
    @dom/html/test/test_bug300691-1.html:93:8
 0:07.16 PASS Modified textnode text 3
 0:07.16 FAIL Removing child textnode shouldn't affect value in edited textarea - got "Testcdefgh", expected "abcdeTesth"
    SimpleTest.is@SimpleTest/SimpleTest.js:507:14
    valueIs@dom/html/test/test_bug300691-1.html:26:5
    @dom/html/test/test_bug300691-1.html:98:8
 0:07.16 PASS Removed textnode 3
 0:07.16 FAIL Inserting child textnode shouldn't affect value in edited textarea - got "Testcdefgh", expected "abcdeTesth"
    SimpleTest.is@SimpleTest/SimpleTest.js:507:14
    valueIs@dom/html/test/test_bug300691-1.html:26:5
    @dom/html/test/test_bug300691-1.html:103:8
 0:07.16 PASS Inserted a text node
 0:07.16 FAIL Normalization changes nothing for the value 3 - got "Testcdefgh", expected "abcdeTesth"
    SimpleTest.is@SimpleTest/SimpleTest.js:507:14
    valueIs@dom/html/test/test_bug300691-1.html:26:5
    @dom/html/test/test_bug300691-1.html:108:8
 0:07.16 PASS Normalization changes nothing for the value 4
 0:07.16 FAIL Setting default value shouldn't affect edited textarea - got "Testcdefgh", expected "abcdeTesth"
    SimpleTest.is@SimpleTest/SimpleTest.js:507:14
    valueIs@dom/html/test/test_bug300691-1.html:26:5
    @dom/html/test/test_bug300691-1.html:112:8
 0:07.16 PASS Just set the default value textarea

I'm working around this in bug 1838045, but it seems it should probably be looked into.

Emilio, could you put a severity on this?

Flags: needinfo?(emilio)

It's likely S3 because it's probably in the "really long-standing" camp, but someone more familiar with editor should look probably. Masayuki?

Flags: needinfo?(emilio) → needinfo?(masayuki)

In my understanding, this bug report is about removing the <link rel="stylesheet" type="text/css" href="..."> causes the odd behavior. However, I cannot reproduce it in any desktop platforms...

If you can reproduce this bug, could you use MOZ_LOG=SelectionAPI:4,sync to investigate who collapse Selection to the start of the text node?

Flags: needinfo?(masayuki) → needinfo?(emilio)

You also need to undo the workaround for this added in https://hg.mozilla.org/mozilla-central/rev/775a6521f77bd6dfb28ea80bb6ea016ad637ed6c after this was filed. If I do that I can repro this, can't you?

Flags: needinfo?(emilio) → needinfo?(masayuki)

Thank you! I reproduce it.

I/SelectionAPI 7f6c0239aac0 Selection::CollapseToStart()
V/SelectionAPI
#01: mozilla::dom::Selection::CollapseToStart(mozilla::ErrorResult&) (/home/toybox/mozilla/src/dom/base/Selection.cpp:2499)
#02: nsFocusManager::MoveCaretToFocus(mozilla::PresShell*, nsIContent*) (/home/toybox/mozilla/src/dom/base/nsFocusManager.cpp:3129)
#03: nsFocusManager::UpdateCaret(bool, bool, nsIContent*) (/home/toybox/mozilla/src/dom/base/nsFocusManager.cpp:3075)
#04: nsFocusManager::Focus(nsPIDOMWindowOuter*, mozilla::dom::Element*, unsigned int, bool, bool, bool, bool, unsigned long, mozilla::Maybe<nsFocusManager::BlurredElementInfo> const&) (/home/toybox/mozilla/src/dom/base/nsFocusManager.cpp:2717)
#05: nsFocusManager::SetFocusInner(mozilla::dom::Element*, int, bool, bool) (/home/toybox/mozilla/src/dom/base/nsFocusManager.cpp:1798)
#06: nsFocusManager::SetFocus(mozilla::dom::Element*, unsigned int) (/home/toybox/mozilla/src/dom/base/nsFocusManager.cpp:476)
#07: mozilla::dom::Element::Focus(mozilla::dom::FocusOptions const&, mozilla::dom::CallerType, mozilla::ErrorResult&) (/home/toybox/mozilla/src/dom/base/Element.cpp:481)
#08: mozilla::dom::HTMLElement_Binding::focus(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) (/home/toybox/mozilla/fx64-dbg/dom/bindings/HTMLElementBinding.cpp:9502)
#09: bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) (/home/toybox/mozilla/src/dom/bindings/BindingUtils.cpp:3329)
#10: CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) (/home/toybox/mozilla/src/js/src/vm/Interpreter.cpp:486)
#11: js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) (/home/toybox/mozilla/src/js/src/vm/Interpreter.cpp:580)
#12: js::Interpret(JSContext*, js::RunState&) (/home/toybox/mozilla/src/js/src/vm/Interpreter.cpp:0)
#13: js::RunScript(JSContext*, js::RunState&) (/home/toybox/mozilla/src/js/src/vm/Interpreter.cpp:458)
#14: js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, js::AbstractFramePtr, JS::MutableHandle<JS::Value>) (/home/toybox/mozilla/src/js/src/vm/Interpreter.cpp:845)
#15: js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) (/home/toybox/mozilla/src/js/src/vm/Interpreter.cpp:877)
#16: ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) (/home/toybox/mozilla/src/js/src/vm/CompilationAndEvaluation.cpp:493)
#17: JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) (/home/toybox/mozilla/src/js/src/vm/CompilationAndEvaluation.cpp:518)
#18: mozilla::dom::JSExecutionContext::ExecScript() (/home/toybox/mozilla/src/dom/base/JSExecutionContext.cpp:241)
#19: mozilla::dom::ScriptLoader::EvaluateScript(nsIGlobalObject*, JS::loader::ScriptLoadRequest*) (/home/toybox/mozilla/src/dom/script/ScriptLoader.cpp:2427)
#20: mozilla::dom::ScriptLoader::EvaluateScriptElement(JS::loader::ScriptLoadRequest*) (/home/toybox/mozilla/src/dom/script/ScriptLoader.cpp:0)
#21: mozilla::dom::ScriptLoader::ProcessRequest(JS::loader::ScriptLoadRequest*) (/home/toybox/mozilla/src/dom/script/ScriptLoader.cpp:1872)
#22: mozilla::dom::ScriptLoader::ProcessInlineScript(nsIScriptElement*, JS::loader::ScriptKind) (/home/toybox/mozilla/src/dom/script/ScriptLoader.cpp:1306)
#23: mozilla::dom::ScriptLoader::ProcessScriptElement(nsIScriptElement*, nsTAutoStringN<char16_t, (unsigned long)64> const&) (/home/toybox/mozilla/src/dom/script/ScriptLoader.cpp:0)
#24: mozilla::dom::ScriptElement::MaybeProcessScript() (/home/toybox/mozilla/src/dom/script/ScriptElement.cpp:182)
#25: nsHtml5TreeOpExecutor::RunScript(nsIContent*) (/home/toybox/mozilla/src/parser/html/nsHtml5TreeOpExecutor.cpp:950)
#26: nsHtml5TreeOpExecutor::RunFlushLoop() (/home/toybox/mozilla/src/parser/html/nsHtml5TreeOpExecutor.cpp:744)
#27: nsHtml5ExecutorReflusher::Run() (/home/toybox/mozilla/src/parser/html/nsHtml5TreeOpExecutor.cpp:82)
#28: mozilla::RunnableTask::Run() (/home/toybox/mozilla/src/xpcom/threads/TaskController.cpp:556)
#29: mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) (/home/toybox/mozilla/src/xpcom/threads/TaskController.cpp:880)
#30: mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) (/home/toybox/mozilla/src/xpcom/threads/TaskController.cpp:0)
#31: mozilla::TaskController::ProcessPendingMTTask(bool) (/home/toybox/mozilla/src/xpcom/threads/TaskController.cpp:491)
#32: mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() (/home/toybox/mozilla/src/xpcom/threads/nsThreadUtils.h:549)
#33: nsThread::ProcessNextEvent(bool, bool*) (/home/toybox/mozilla/src/xpcom/threads/nsThread.cpp:1203)

Element::Focus() collapse Selection to its start. After that, I see the following warnings:

WARNING: Failed to do command from nsIControllerCommand::DoCommand(): 'NS_SUCCEEDED(rv)', file /home/toybox/mozilla/src/editor/libeditor/EditorCommands.cpp:69
WARNING: Failed to do command from nsIControllerCommand::DoCommand(): 'NS_SUCCEEDED(rv)', file /home/toybox/mozilla/src/editor/libeditor/EditorCommands.cpp:69
WARNING: Failed to do command from nsIControllerCommand::DoCommand(): 'NS_SUCCEEDED(rv)', file /home/toybox/mozilla/src/editor/libeditor/EditorCommands.cpp:69

So the command controller couldn't handle arrow key events. Therefore, the inserted string is not properly handled.

Flags: needinfo?(masayuki)

Should synthesizeKey in EventUtils.js or TextInputProcessor::Keydown flush pending things? I'm afraid about performance regression of the automated tests...

Ah, no. a call of t.getBoundingClientRect() after t.focus() does not fix this bug.

Oh, I misunderstood. The problem here is, <textarea>.focus() does not collapse selection to end of itself, instead collapses to start.

Without the workaround, I also see this:

I/SelectionAPI 7f876e999ac0 Selection::CollapseToStart()
V/SelectionAPI
#01: mozilla::dom::Selection::CollapseToStart(mozilla::ErrorResult&) (/home/toybox/mozilla/src/dom/base/Selection.cpp:2499)
#02: nsFocusManager::MoveCaretToFocus(mozilla::PresShell*, nsIContent*) (/home/toybox/mozilla/src/dom/base/nsFocusManager.cpp:3129)
#03: nsFocusManager::UpdateCaret(bool, bool, nsIContent*) (/home/toybox/mozilla/src/dom/base/nsFocusManager.cpp:3075)
#04: nsFocusManager::Focus(nsPIDOMWindowOuter*, mozilla::dom::Element*, unsigned int, bool, bool, bool, bool, unsigned long, mozilla::Maybe<nsFocusManager::BlurredElementInfo> const&) (/home/toybox/mozilla/src/dom/base/nsFocusManager.cpp:2717)
#05: nsFocusManager::SetFocusInner(mozilla::dom::Element*, int, bool, bool) (/home/toybox/mozilla/src/dom/base/nsFocusManager.cpp:1798)
#06: nsFocusManager::SetFocus(mozilla::dom::Element*, unsigned int) (/home/toybox/mozilla/src/dom/base/nsFocusManager.cpp:476)
#07: mozilla::dom::Element::Focus(mozilla::dom::FocusOptions const&, mozilla::dom::CallerType, mozilla::ErrorResult&) (/home/toybox/mozilla/src/dom/base/Element.cpp:481)
#08: mozilla::dom::HTMLElement_Binding::focus(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) (/home/toybox/mozilla/fx64-dbg/dom/bindings/HTMLElementBinding.cpp:9502)

After that, oddly I see this Selection API call:

I/SelectionAPI 7f876e9d9f20 Selection::CollapseInLimiter(aPoint={ mParent=0x7f877170e180 (#text.div.textarea['target'].p['display'].body.html.#document, Length()=8), mRef=0, mOffset=7, mIsMutationObserved=true })
V/SelectionAPI
#01: mozilla::dom::Selection::CollapseInLimiter(mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&, mozilla::ErrorResult&) (/home/toybox/mozilla/src/dom/base/Selection.cpp:2365)
#02: mozilla::dom::Selection::CollapseInLimiter(mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&) (/home/toybox/mozilla/src/dom/base/Selection.h:220)
#03: nsFrameSelection::TakeFocus(nsIContent&, unsigned int, unsigned int, mozilla::CaretAssociationHint, nsFrameSelection::FocusMode) (/home/toybox/mozilla/src/layout/generic/nsFrameSelection.cpp:1438)
#04: nsFrameSelection::MoveCaret(nsDirection, bool, nsSelectionAmount, nsFrameSelection::CaretMovementStyle) (/home/toybox/mozilla/src/layout/generic/nsFrameSelection.cpp:0)
#05: mozilla::TextInputSelectionController::CharacterMove(bool, bool) (/home/toybox/mozilla/src/dom/html/TextControlState.cpp:618)
#06: mozilla::SelectionMoveCommands::DoCommand(mozilla::Command, mozilla::EditorBase&, nsIPrincipal*) const (/home/toybox/mozilla/src/editor/libeditor/EditorCommands.cpp:0)
#07: mozilla::EditorCommand::DoCommand(char const*, nsISupports*) (/home/toybox/mozilla/src/editor/libeditor/EditorCommands.cpp:65)
#08: nsControllerCommandTable::DoCommand(char const*, nsISupports*) (/home/toybox/mozilla/src/dom/commandhandler/nsControllerCommandTable.cpp:138)
#09: nsBaseCommandController::DoCommand(char const*) (/home/toybox/mozilla/src/dom/commandhandler/nsBaseCommandController.cpp:114)
#10: mozilla::DoCommandCallback(mozilla::Command, void*) (/home/toybox/mozilla/src/dom/html/TextControlState.cpp:0)
#11: mozilla::WidgetKeyboardEvent::ExecuteEditCommands(mozilla::NativeKeyBindingsType, void (*)(mozilla::Command, void*), void*) (/home/toybox/mozilla/src/widget/WidgetEventImpl.cpp:892)
#12: mozilla::TextInputListener::HandleEvent(mozilla::dom::Event*)::$_0::operator()(mozilla::TextControlElement&) const (/home/toybox/mozilla/src/dom/html/TextControlState.cpp:995)
#13: mozilla::TextInputListener::HandleEvent(mozilla::dom::Event*) (/home/toybox/mozilla/src/dom/html/TextControlState.cpp:1006)

The <textarea>.value is "abcdefgh" whose length is 8. So, oddly, somebody silently updated the Selection between them...

Ah, the Selection::CollapseToStart() does nothing. Actually, it's here:

I/SelectionAPI 7f876e9d9f20 Selection::CollapseInLimiter(aPoint={ mParent=0x7f877170e180 (#text.div.textarea['target'].p['display'].body.html.#document, Length()=8), mRef=0, mOffset=8, mIsMutationObserved=true })
V/SelectionAPI
#01: mozilla::dom::Selection::CollapseInLimiter(mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&, mozilla::ErrorResult&) (/home/toybox/mozilla/src/dom/base/Selection.cpp:2365)
#02: void mozilla::EditorBase::CollapseSelectionTo<nsINode*, nsIContent*>(mozilla::EditorDOMPointBase<nsINode*, nsIContent*> const&, mozilla::ErrorResult&) const (/home/toybox/mozilla/src/editor/libeditor/EditorBase.h:1909)
#03: mozilla::EditorBase::SetTextNodeWithoutTransaction(nsTSubstring<char16_t> const&, mozilla::dom::Text&) (/home/toybox/mozilla/src/editor/libeditor/EditorBase.cpp:3453)
#04: mozilla::TextEditor::SetTextWithoutTransaction(nsTSubstring<char16_t> const&) (/home/toybox/mozilla/src/editor/libeditor/TextEditSubActionHandler.cpp:578)
#05: mozilla::TextEditor::SetTextAsSubAction(nsTSubstring<char16_t> const&) (/home/toybox/mozilla/src/editor/libeditor/TextEditor.cpp:425)
#06: mozilla::TextEditor::SetTextAsAction(nsTSubstring<char16_t> const&, mozilla::EditorBase::AllowBeforeInputEventCancelable, nsIPrincipal*) (/home/toybox/mozilla/src/editor/libeditor/TextEditor.cpp:397)
#07: mozilla::TextControlState::SetValueWithTextEditor(mozilla::AutoTextControlHandlingState&) (/home/toybox/mozilla/src/dom/html/TextControlState.cpp:2815)
#08: mozilla::TextControlState::SetValue(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const*, mozilla::EnumSet<mozilla::TextControlState::ValueSetterOption, unsigned int> const&) (/home/toybox/mozilla/src/dom/html/TextControlState.cpp:0)
#09: mozilla::dom::HTMLTextAreaElement::SetValueInternal(nsTSubstring<char16_t> const&, mozilla::EnumSet<mozilla::TextControlState::ValueSetterOption, unsigned int> const&) (/home/toybox/mozilla/src/dom/html/HTMLTextAreaElement.cpp:0)
#10: mozilla::dom::HTMLTextAreaElement::Reset() (/home/toybox/mozilla/src/dom/html/HTMLTextAreaElement.cpp:666)
#11: mozilla::detail::RunnableFunction<mozilla::dom::HTMLTextAreaElement::ContentChanged(nsIContent*)::$_0>::Run() (/home/toybox/mozilla/fx64-dbg/dist/include/nsThreadUtils.h:549)
#12: nsContentUtils::RemoveScriptBlocker() (/home/toybox/mozilla/src/dom/base/nsContentUtils.cpp:5987)
#13: mozilla::dom::Document::EndUpdate() (/home/toybox/mozilla/src/dom/base/Document.cpp:7969)
#14: mozAutoDocUpdate::~mozAutoDocUpdate() (/home/toybox/mozilla/src/dom/base/mozAutoDocUpdate.h:0)
#15: nsINode::ReplaceOrInsertBefore(bool, nsINode*, nsINode*, mozilla::ErrorResult&) (/home/toybox/mozilla/src/dom/base/nsINode.cpp:0)
#16: mozilla::dom::Node_Binding::appendChild(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) (/home/toybox/mozilla/fx64-dbg/dom/bindings/NodeBinding.cpp:960)
#17: bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) (/home/toybox/mozilla/src/dom/bindings/BindingUtils.cpp:3329)
#18: CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) (/home/toybox/mozilla/src/js/src/vm/Interpreter.cpp:486)
#19: js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) (/home/toybox/mozilla/src/js/src/vm/Interpreter.cpp:580)
#20: js::Interpret(JSContext*, js::RunState&) (/home/toybox/mozilla/src/js/src/vm/Interpreter.cpp:0)
#21: js::RunScript(JSContext*, js::RunState&) (/home/toybox/mozilla/src/js/src/vm/Interpreter.cpp:458)
#22: js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) (/home/toybox/mozilla/src/js/src/vm/Interpreter.cpp:612)
#23: js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) (/home/toybox/mozilla/src/js/src/vm/Interpreter.cpp:679)
#24: JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) (/home/toybox/mozilla/src/js/src/vm/CallAndConstruct.cpp:117)
#25: mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) (/home/toybox/mozilla/fx64-dbg/dom/bindings/EventHandlerBinding.cpp:65)
#26: void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) (/home/toybox/mozilla/fx64-dbg/dist/include/mozilla/dom/EventHandlerBinding.h:0)
#27: mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) (/home/toybox/mozilla/src/dom/events/JSEventHandler.cpp:199)
#28: mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) (/home/toybox/mozilla/src/dom/events/EventListenerManager.cpp:1241)
#29: mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) (/home/toybox/mozilla/src/dom/events/EventListenerManager.cpp:1427)
#30: mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) (/home/toybox/mozilla/src/dom/events/EventDispatcher.cpp:345)
#31: mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) (/home/toybox/mozilla/src/dom/events/EventDispatcher.cpp:563)
#32: mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) (/home/toybox/mozilla/src/dom/events/EventDispatcher.cpp:0)
#33: nsDocumentViewer::LoadComplete(nsresult) (/home/toybox/mozilla/src/layout/base/nsDocumentViewer.cpp:0)
#34: nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) (/home/toybox/mozilla/src/docshell/base/nsDocShell.cpp:0)

So, when load event is fired, pending HTMLTextAreaElement::Reset() is executed and TextEditor initializes the Selection to end of the default value.

Without the workaround, similar thing is done within this stack:

I/SelectionAPI 7ff968527040 Selection::CollapseInLimiter(aPoint={ mParent=0x7ff96b40e280 (#text.div.textarea['target'].p['display'].body.html.#document, Length()=8), mRef=0, mOffset=8, mIsMutationObserved=true })
V/SelectionAPI
#01: mozilla::dom::Selection::CollapseInLimiter(mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&, mozilla::ErrorResult&) (/home/toybox/mozilla/src/dom/base/Selection.cpp:2365)
#02: void mozilla::EditorBase::CollapseSelectionTo<nsINode*, nsIContent*>(mozilla::EditorDOMPointBase<nsINode*, nsIContent*> const&, mozilla::ErrorResult&) const (/home/toybox/mozilla/src/editor/libeditor/EditorBase.h:1909)
#03: mozilla::EditorBase::SetTextNodeWithoutTransaction(nsTSubstring<char16_t> const&, mozilla::dom::Text&) (/home/toybox/mozilla/src/editor/libeditor/EditorBase.cpp:3453)
#04: mozilla::TextEditor::SetTextWithoutTransaction(nsTSubstring<char16_t> const&) (/home/toybox/mozilla/src/editor/libeditor/TextEditSubActionHandler.cpp:578)
#05: mozilla::TextEditor::SetTextAsSubAction(nsTSubstring<char16_t> const&) (/home/toybox/mozilla/src/editor/libeditor/TextEditor.cpp:425)
#06: mozilla::TextEditor::SetTextAsAction(nsTSubstring<char16_t> const&, mozilla::EditorBase::AllowBeforeInputEventCancelable, nsIPrincipal*) (/home/toybox/mozilla/src/editor/libeditor/TextEditor.cpp:397)
#07: mozilla::TextControlState::SetValueWithTextEditor(mozilla::AutoTextControlHandlingState&) (/home/toybox/mozilla/src/dom/html/TextControlState.cpp:2815)
#08: mozilla::TextControlState::SetValue(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const*, mozilla::EnumSet<mozilla::TextControlState::ValueSetterOption, unsigned int> const&) (/home/toybox/mozilla/src/dom/html/TextControlState.cpp:0)
#09: mozilla::TextControlState::PrepareEditor(nsTSubstring<char16_t> const*) (/home/toybox/mozilla/src/dom/html/TextControlState.cpp:1924)
#10: nsTextControlFrame::EnsureEditorInitialized() (/home/toybox/mozilla/src/layout/forms/nsTextControlFrame.cpp:310)
#11: nsTextControlFrame::EditorInitializer::Run() (/home/toybox/mozilla/src/layout/forms/nsTextControlFrame.cpp:1320)
#12: nsContentUtils::RemoveScriptBlocker() (/home/toybox/mozilla/src/dom/base/nsContentUtils.cpp:5987)
#13: mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) (/home/toybox/mozilla/src/layout/base/PresShell.cpp:4334)
#14: mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) (/home/toybox/mozilla/src/dom/base/Document.cpp:10913)
#15: nsFocusManager::FlushAndCheckIfFocusable(mozilla::dom::Element*, unsigned int) (/home/toybox/mozilla/src/dom/base/nsFocusManager.cpp:2120)
#16: nsFocusManager::SetFocusInner(mozilla::dom::Element*, int, bool, bool) (/home/toybox/mozilla/src/dom/base/nsFocusManager.cpp:1482)
#17: nsFocusManager::SetFocus(mozilla::dom::Element*, unsigned int) (/home/toybox/mozilla/src/dom/base/nsFocusManager.cpp:476)
#18: mozilla::dom::Element::Focus(mozilla::dom::FocusOptions const&, mozilla::dom::CallerType, mozilla::ErrorResult&) (/home/toybox/mozilla/src/dom/base/Element.cpp:481)
#19: mozilla::dom::HTMLElement_Binding::focus(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) (/home/toybox/mozilla/fx64-dbg/dom/bindings/HTMLElementBinding.cpp:9502)

Then, I see these stacks:

I/SelectionAPI 7ff968527040 Selection::SetStartAndEndInLimiter(aStartContainer=aEndContainer=#text.div.textarea['target'].p['display'].body.html.#document, aStartOffset=aEndOffset=0, nsDirection=eDirNext, aReason=256)
V/SelectionAPI
#01: mozilla::dom::Selection::SetStartAndEndInLimiter(nsINode&, unsigned int, nsINode&, unsigned int, nsDirection, short) (/home/toybox/mozilla/src/dom/base/Selection.cpp:3862)
#02: nsTextControlFrame::SetSelectionInternal(nsINode*, unsigned int, nsINode*, unsigned int, nsITextControlFrame::SelectionDirection) (/home/toybox/mozilla/src/layout/forms/nsTextControlFrame.cpp:912)
#03: nsTextControlFrame::SetSelectionEndPoints(unsigned int, unsigned int, nsITextControlFrame::SelectionDirection) (/home/toybox/mozilla/src/layout/forms/nsTextControlFrame.cpp:988)
#04: nsTextControlFrame::EnsureEditorInitialized() (/home/toybox/mozilla/src/layout/forms/nsTextControlFrame.cpp:0)
#05: nsTextControlFrame::EditorInitializer::Run() (/home/toybox/mozilla/src/layout/forms/nsTextControlFrame.cpp:1320)
#06: nsContentUtils::RemoveScriptBlocker() (/home/toybox/mozilla/src/dom/base/nsContentUtils.cpp:5987)
#07: mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) (/home/toybox/mozilla/src/layout/base/PresShell.cpp:4334)
#08: mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) (/home/toybox/mozilla/src/dom/base/Document.cpp:10913)
#09: nsFocusManager::FlushAndCheckIfFocusable(mozilla::dom::Element*, unsigned int) (/home/toybox/mozilla/src/dom/base/nsFocusManager.cpp:2120)
#10: nsFocusManager::SetFocusInner(mozilla::dom::Element*, int, bool, bool) (/home/toybox/mozilla/src/dom/base/nsFocusManager.cpp:1482)
#11: nsFocusManager::SetFocus(mozilla::dom::Element*, unsigned int) (/home/toybox/mozilla/src/dom/base/nsFocusManager.cpp:476)
#12: mozilla::dom::Element::Focus(mozilla::dom::FocusOptions const&, mozilla::dom::CallerType, mozilla::ErrorResult&) (/home/toybox/mozilla/src/dom/base/Element.cpp:481)
#13: mozilla::dom::HTMLElement_Binding::focus(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) (/home/toybox/mozilla/fx64-dbg/dom/bindings/HTMLElementBinding.cpp:9502)

I/SelectionAPI 7ff968527040 Selection::SetStartAndEndInLimiter(aStartContainer=aEndContainer=#text.div.textarea['target'].p['display'].body.html.#document, aStartOffset=aEndOffset=0, nsDirection=eDirNext, aReason=256)
V/SelectionAPI
#01: mozilla::dom::Selection::SetStartAndEndInLimiter(nsINode&, unsigned int, nsINode&, unsigned int, nsDirection, short) (/home/toybox/mozilla/src/dom/base/Selection.cpp:3862)
#02: nsTextControlFrame::SetSelectionInternal(nsINode*, unsigned int, nsINode*, unsigned int, nsITextControlFrame::SelectionDirection) (/home/toybox/mozilla/src/layout/forms/nsTextControlFrame.cpp:912)
#03: nsTextControlFrame::SetSelectionEndPoints(unsigned int, unsigned int, nsITextControlFrame::SelectionDirection) (/home/toybox/mozilla/src/layout/forms/nsTextControlFrame.cpp:988)
#04: mozilla::RestoreSelectionState::Run() (/home/toybox/mozilla/src/dom/html/TextControlState.cpp:203)
#05: nsContentUtils::RemoveScriptBlocker() (/home/toybox/mozilla/src/dom/base/nsContentUtils.cpp:5987)
#06: nsTextControlFrame::EditorInitializer::Run() (/home/toybox/mozilla/src/layout/forms/nsTextControlFrame.cpp:1371)
#07: nsContentUtils::RemoveScriptBlocker() (/home/toybox/mozilla/src/dom/base/nsContentUtils.cpp:5987)
#08: mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) (/home/toybox/mozilla/src/layout/base/PresShell.cpp:4334)
#09: mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) (/home/toybox/mozilla/src/dom/base/Document.cpp:10913)
#10: nsFocusManager::FlushAndCheckIfFocusable(mozilla::dom::Element*, unsigned int) (/home/toybox/mozilla/src/dom/base/nsFocusManager.cpp:2120)
#11: nsFocusManager::SetFocusInner(mozilla::dom::Element*, int, bool, bool) (/home/toybox/mozilla/src/dom/base/nsFocusManager.cpp:1482)
#12: nsFocusManager::SetFocus(mozilla::dom::Element*, unsigned int) (/home/toybox/mozilla/src/dom/base/nsFocusManager.cpp:476)
#13: mozilla::dom::Element::Focus(mozilla::dom::FocusOptions const&, mozilla::dom::CallerType, mozilla::ErrorResult&) (/home/toybox/mozilla/src/dom/base/Element.cpp:481)
#14: mozilla::dom::HTMLElement_Binding::focus(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) (/home/toybox/mozilla/fx64-dbg/dom/bindings/HTMLElementBinding.cpp:9502)
Severity: -- → S3
You need to log in before you can comment on or make changes to this bug.