1858794 - Assertion failure: aPoint.IsSetAndValid(), at /builds/worker/workspace/obj-build/dist/include/mozilla/EditorDOMPoint.h:1567

Status: VERIFIED FIXED

(Core :: DOM: Editor, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20230927-583f2081d1ac (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: aPoint.IsSetAndValid(), at /builds/worker/workspace/obj-build/dist/include/mozilla/EditorDOMPoint.h:1567

#0 0x7f8da9ddb15c in mozilla::AutoEditorDOMPointChildInvalidator::AutoEditorDOMPointChildInvalidator(mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent>>&) /builds/worker/workspace/obj-build/dist/include/mozilla/EditorDOMPoint.h:1567:5
#1 0x7f8da9e5f472 in AutoEditorDOMRangeChildrenInvalidator /builds/worker/workspace/obj-build/dist/include/mozilla/EditorDOMPoint.h:1596:9
#2 0x7f8da9e5f472 in mozilla::HTMLEditor::AutoMoveOneLineHandler::Run(mozilla::HTMLEditor&, mozilla::dom::Element const&) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditorDeleteHandler.cpp:5401:45
#3 0x7f8da9edc51d in mozilla::WhiteSpaceVisibilityKeeper::MergeFirstLineOfRightBlockElementIntoDescendantLeftBlockElement(mozilla::HTMLEditor&, mozilla::dom::Element&, mozilla::dom::Element&, mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent>> const&, mozilla::Maybe<nsAtom*> const&, mozilla::dom::HTMLBRElement const*, mozilla::dom::Element const&) /builds/worker/checkouts/gecko/editor/libeditor/WSRunObject.cpp:319:35
#4 0x7f8da9e501af in mozilla::HTMLEditor::AutoDeleteRangesHandler::AutoBlockElementsJoiner::AutoInclusiveAncestorBlockElementsJoiner::Run(mozilla::HTMLEditor&, mozilla::dom::Element const&) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditorDeleteHandler.cpp:4998:14
#5 0x7f8da9e5a875 in mozilla::HTMLEditor::AutoDeleteRangesHandler::AutoBlockElementsJoiner::HandleDeleteNonCollapsedRanges(mozilla::HTMLEditor&, short, short, mozilla::AutoRangeArray&, mozilla::HTMLEditor::AutoDeleteRangesHandler::SelectionWasCollapsed, mozilla::dom::Element const&) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditorDeleteHandler.cpp:3997:16
#6 0x7f8da9e54d7a in mozilla::HTMLEditor::AutoDeleteRangesHandler::AutoBlockElementsJoiner::Run(mozilla::HTMLEditor&, short, short, mozilla::AutoRangeArray&, mozilla::HTMLEditor::AutoDeleteRangesHandler::SelectionWasCollapsed, mozilla::dom::Element const&) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditorDeleteHandler.cpp:654:15
#7 0x7f8da9e46834 in mozilla::HTMLEditor::AutoDeleteRangesHandler::HandleDeleteNonCollapsedRanges(mozilla::HTMLEditor&, short, short, mozilla::AutoRangeArray&, mozilla::HTMLEditor::AutoDeleteRangesHandler::SelectionWasCollapsed, mozilla::dom::Element const&) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditorDeleteHandler.cpp:3355:14
#8 0x7f8da9e40ad5 in mozilla::HTMLEditor::AutoDeleteRangesHandler::Run(mozilla::HTMLEditor&, short, short, mozilla::AutoRangeArray&, mozilla::dom::Element const&) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditorDeleteHandler.cpp:1708:47
#9 0x7f8da9e403ff in mozilla::HTMLEditor::HandleDeleteSelection(short, short) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditorDeleteHandler.cpp:1165:61
#10 0x7f8da9d6af4c in mozilla::EditorBase::DeleteSelectionAsSubAction(short, short) /builds/worker/checkouts/gecko/editor/libeditor/EditorBase.cpp:4438:9
#11 0x7f8da9d65520 in mozilla::EditorBase::DeleteSelectionAsAction(short, short, nsIPrincipal*) /builds/worker/checkouts/gecko/editor/libeditor/EditorBase.cpp:4401:8
#12 0x7f8da9d84f88 in mozilla::DeleteCommand::DoCommand(mozilla::Command, mozilla::EditorBase&, nsIPrincipal*) const /builds/worker/checkouts/gecko/editor/libeditor/EditorCommands.cpp:623:29
#13 0x7f8da6327e18 in mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Document.cpp:5491:37
#14 0x7f8da75e1461 in mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./DocumentBinding.cpp:4007:36
#15 0x7f8da79255f8 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3327:13
#16 0x7f8dac0c65b4 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:486:13
#17 0x7f8dac0c5ecd in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:580:12
#18 0x7f8dac0d6498 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:652:10
#19 0x7f8dac0d6498 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3407:16
#20 0x7f8dac0c5422 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:458:13
#21 0x7f8dac0c5ee9 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:612:13
#22 0x7f8dac0c738d in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:679:8
#23 0x7f8dac1adf74 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:119:10
#24 0x7f8da763d39b in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventHandlerBinding.cpp:65:37
#25 0x7f8da7fb3519 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget>>(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:82:12
#26 0x7f8da7fb25e9 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /builds/worker/checkouts/gecko/dom/events/JSEventHandler.cpp:199:12
#27 0x7f8da7f8f7d5 in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1348:22
#28 0x7f8da7f908d4 in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1663:12
#29 0x7f8da7f90149 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1560:35
#30 0x7f8da7f836ef in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:465:5
#31 0x7f8da7f836ef in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:363:17
#32 0x7f8da7f82dbb in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:651:14
#33 0x7f8da7f85636 in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1225:11
#34 0x7f8daa00e0e8 in mozilla::AnimationEventInfo::Dispatch(nsPresContext*) /builds/worker/workspace/obj-build/dist/include/mozilla/AnimationEventDispatcher.h:264:5
#35 0x7f8daa00575a in mozilla::AnimationEventDispatcher::DispatchEvents() /builds/worker/workspace/obj-build/dist/include/mozilla/AnimationEventDispatcher.h:295:12
#36 0x7f8daa005584 in nsRefreshDriver::DispatchAnimationEvents() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2290:17
#37 0x7f8daa0030dc in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2650:7
#38 0x7f8daa00c4b1 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:363:13
#39 0x7f8daa00c4b1 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:341:7
#40 0x7f8daa00c3b0 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:357:5
#41 0x7f8daa00c24d in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:924:5
#42 0x7f8daa00b599 in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:838:5
#43 0x7f8daa00a8f9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:582:14
#44 0x7f8da934baab in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:66:15
#45 0x7f8da964458a in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:220:78
#46 0x7f8da95265f0 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8646:32
#47 0x7f8da5412f6f in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1800:25
#48 0x7f8da540fcc2 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1725:9
#49 0x7f8da5410942 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1525:3
#50 0x7f8da5411a8f in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1623:14
#51 0x7f8da47444b7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:549:16
#52 0x7f8da473c073 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:876:26
#53 0x7f8da473a8b7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:699:15
#54 0x7f8da473ad15 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:485:36
#55 0x7f8da47481c6 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:211:37
#56 0x7f8da47481c6 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#57 0x7f8da475ebd2 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1198:16
#58 0x7f8da4765cbd in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#59 0x7f8da5418ed5 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#60 0x7f8da5333591 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#61 0x7f8da5333591 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#62 0x7f8da9c4f598 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#63 0x7f8dabe8777b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:721:20
#64 0x7f8da5419db6 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#65 0x7f8da5333591 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#66 0x7f8da5333591 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#67 0x7f8dabe86fe2 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:656:34
#68 0x55e1df209236 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#69 0x55e1df209236 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:375:18
#70 0x7f8db8a29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#71 0x7f8db8a29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#72 0x55e1df1def68 in _start (/home/user/workspace/browsers/m-c-20231011211944-fuzzing-debug/firefox-bin+0x58f68) (BuildId: 2eb5cce7d8cf9cabd42b9b13372b658517f57670)

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20231012211841-a5369079cd89.
The bug appears to have been introduced in the following build range:

Start: 583cfd323dab818e35dc1f15fa3e92a503e56e11 (20230927023537)
End: 82ae09837aed66d319e3280febbf971a401bd8a6 (20230927062331)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=583cfd323dab818e35dc1f15fa3e92a503e56e11&tochange=82ae09837aed66d319e3280febbf971a401bd8a6

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1851951

:masayuki, since you are the author of the regressor, bug 1851951, could you take a look?

For more information, please visit BugBot documentation.

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Ah, this is a bigger issue than I've expected.

The issue is here:

      else if (content->IsComment() ||
               HTMLEditUtils::IsEmptyInlineContainer(
                   content,
                   {EmptyCheckOption::TreatSingleBRElementAsVisible,
                    EmptyCheckOption::TreatListItemAsVisible,
                    EmptyCheckOption::TreatTableCellAsVisible},
                   BlockInlineCheck::UseComputedDisplayOutsideStyle)) {

And the utility method does:

    return HTMLEditUtils::IsInlineContent(aContent, aBlockInlineCheck) &&
           HTMLEditUtils::IsContainerNode(aContent) &&
           HTMLEditUtils::IsEmptyNode(aContent, aOptions);

So, the first check refers the computed style, but IsEmptyNode checks TreatListItemAsVisible etc with HTML tag names.
https://searchfox.org/mozilla-central/rev/81f368dab93fff035ce7fcc376e16990e89dd5ec/editor/libeditor/HTMLEditUtils.cpp#949-950,952-953

I wonder, HTMLEditUtils::IsListItem and HTMLEditUtils::IsTableCell should check the style, but I'm not sure it's reasonable for any callers of them...

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1851951

Comment 5

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

I was thinking that HTMLEditUtils::IsListItem should have BlockInlineCheck argument. However, most of them are BlockInlineCheck::UseHTMLDefaultStyle because they work with known block elements in most cases. So, doing that may be over-kill for this issue. On the other hand, IsEmptyNode is used for the visual reason.
https://searchfox.org/mozilla-central/search?q=symbol:_ZN7mozilla13HTMLEditUtils11IsEmptyNodeERK7nsINodeRKNS_7EnumSetINS0_16EmptyCheckOptionEjEEPb&redirect=false

Therefore, making it check the style seems enough.

Comment 6

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Ah, it's not related for the testcase. This is just caused by the <svg> element becomes a block. However, the issue I mentioned in the previous comments is still important for shipping bug 1851951. I'll file a new bug.

Comment 7

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Filed bug 1861603 for the bigger change.

Comment 8

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Bug 1858794 - Make `AutoMoveOneLineHandler` track the new line range while moving content nodes r=m_kato!

It moves nodes in a range to new place one by one. At this time, the moved
position range is not tracked. Therefore, if the DOM tree is unexpectedly
changed by HTMLEditor itself, the range gets broken. E.g., in this case,
deleting empty inline element causes the range after the source position is
broken.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a7200c4d402a
Make `AutoMoveOneLineHandler` track the new line range while moving content nodes r=m_kato

Comment 10

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/42880 for changes under testing/web-platform/tests

Comment 11

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Bug 1858794 - Make `HTMLEditUtils::IsEmptyNode` refer the computed style r=m_kato!

Gecko starts referring computed style to consider whether block or inline and
HTMLEditUtils::IsEmptyNode is used with them to check a node like these:
https://searchfox.org/mozilla-central/rev/40d51bef58b8e901d6ab4b60dd280f372a0e417d/editor/libeditor/HTMLEditUtils.h#543,554

However, IsEmptyNode still checks only the tag names when the caller wants
to treat "list items" and/or "table cells" are visible (not empty). Therefore,
this mismatch may cause the assertion failure reported in the bug.

From code design point of view, HTMLEditUtils::IsListItem and
HTMLEditUtils::IsTableCell should refer the computed style. However, the
former is mostly used for checking the logical structure of HTML, and in the
latter case, we should keep the table structure even if table cells are styled
as inline because browsers do not support table structure recreation except
the Gecko specific editing UI (called inline table editor). Therefore, it does
not make sense that we would change them.

Instead, we should change IsEmptyNode which is used only for visibility check.
So, using computed style is always reasonable.

Note that this patch changes the behavior in some edge cases. The method always
treat a list item or a table cell which contains a sub-list or a sub table.
However, I would not like to add new EmptyCheckOption for it to check the
complicated style check. Therefore, this patch changes the behavior to treat
them visible if and only if they have another list item or another table cell.
Basically, <table> and list elements should have a least one table cell or
one list item. Therefore, this change should not appear in the web apps in the
wild.

Comment 12

[Phabricator Automation]

Comment on attachment 9361360 [details]
Bug 1858794 - Make HTMLEditUtils::IsEmptyNode refer the computed style r=m_kato!

Revision D192442 was moved to bug 1861603. Setting attachment 9361360 [details] to obsolete.

Comment 13

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/a7200c4d402a

Comment 14

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:masayuki, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox120 to wontfix.

For more information, please visit BugBot documentation.

Comment 15

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20231101093520-b73ef4c8979f.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 16

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

The new behavior is available only early beta builds or earlier. Therefore, we can wait to ship this fix.