Closed Bug 1870960 Opened 6 months ago Closed 5 months ago

Assertion failure: currentTextInputHandlingWidget == textInputHandlingWidget, at /builds/worker/checkouts/gecko/dom/events/IMEStateManager.cpp:2288

Categories

(Core :: DOM: Editor, defect, P3)

Product:
Core
Component:
DOM: Editor
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
123 Branch
Tracking Flags:
Tracking Status
firefox-esr115 --- unaffected
firefox121 --- wontfix
firefox122 --- wontfix
firefox123 --- verified

People

(Reporter: tsmith, Assigned: masayuki)

References

(Blocks 2 open bugs, Regression)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])

Attachments

(2 files)

testcase.html
241 bytes, text/html
Details
Bug 1870960 - Make `IMEStateManager` stop using `nsPresContext::GetTextInputHandlingWidget()` as far as possible r=smaug!,#dom-core
48 bytes, text/x-phabricator-request
Details | Review

Found while fuzzing m-c 20231203-8e959a7ded5f (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: currentTextInputHandlingWidget == textInputHandlingWidget, at /builds/worker/checkouts/gecko/dom/events/IMEStateManager.cpp:2322

#0 0x7f9871d9bfc4 in mozilla::IMEStateManager::CreateIMEContentObserver(mozilla::EditorBase&, mozilla::dom::Element*) /builds/worker/checkouts/gecko/dom/events/IMEStateManager.cpp:2322:5
#1 0x7f9871da068a in mozilla::IMEStateManager::UpdateIMEState(mozilla::widget::IMEState const&, mozilla::dom::Element*, mozilla::EditorBase&, mozilla::EnumSet<mozilla::IMEStateManager::UpdateIMEStateOption, unsigned int> const&) /builds/worker/checkouts/gecko/dom/events/IMEStateManager.cpp:1379:7
#2 0x7f9873bebdc0 in mozilla::EditorBase::PostCreateInternal() /builds/worker/checkouts/gecko/editor/libeditor/EditorBase.cpp:446:5
#3 0x7f9873c923c7 in mozilla::HTMLEditor::PostCreate() /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditor.cpp:470:17
#4 0x7f9873dcabbd in nsEditingSession::SetupEditorOnWindow(nsPIDOMWindowOuter&) /builds/worker/checkouts/gecko/editor/composer/nsEditingSession.cpp:436:22
#5 0x7f9873dc94a6 in nsEditingSession::MakeWindowEditable(mozIDOMWindowProxy*, char const*, bool, bool, bool) /builds/worker/checkouts/gecko/editor/composer/nsEditingSession.cpp:166:10
#6 0x7f9870209f86 in mozilla::dom::Document::EditingStateChanged() /builds/worker/checkouts/gecko/dom/base/Document.cpp:6191:25
#7 0x7f9870209092 in mozilla::dom::Document::SetDesignMode(nsTSubstring<char16_t> const&, mozilla::Maybe<nsIPrincipal*> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Document.cpp:4614:10
#8 0x7f9870208eac in mozilla::dom::Document::SetDesignMode(nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Document.cpp:4584:3
#9 0x7f98713f2cfe in mozilla::dom::Document_Binding::set_designMode(JSContext*, JS::Handle<JSObject*>, void*, JSJitSetterCallArgs) /builds/worker/workspace/obj-build/dom/bindings/./DocumentBinding.cpp:3952:24
#10 0x7f987170869a in bool mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::NormalThisPolicy>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3206:8
#11 0x7f9875de0f44 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:479:13
#12 0x7f9875de089b in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:573:12
#13 0x7f9875de1b6d in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:672:8
#14 0x7f9875de2e44 in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:803:10
#15 0x7f9876048c60 in SetExistingProperty(JSContext*, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<js::NativeObject*>, js::PropertyResult const&, JS::ObjectOpResult&) /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2588:8
#16 0x7f9876047c75 in bool js::NativeSetProperty<(js::QualifiedBool)1>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2622:14
#17 0x7f9876369e30 in js::SetPropertyIgnoringNamedGetter(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<mozilla::Maybe<JS::PropertyDescriptor>>, JS::ObjectOpResult&) /builds/worker/checkouts/gecko/js/src/proxy/BaseProxyHandler.cpp:175:14
#18 0x7f987171ed44 in mozilla::dom::DOMProxyHandler::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) const /builds/worker/checkouts/gecko/dom/bindings/DOMJSProxyHandler.cpp:248:10
#19 0x7f987637b033 in js::Proxy::setInternal(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /builds/worker/checkouts/gecko/js/src/proxy/Proxy.cpp:593:19
#20 0x7f987637abca in js::Proxy::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /builds/worker/checkouts/gecko/js/src/proxy/Proxy.cpp:601:10
#21 0x7f9875dee145 in SetObjectElementOperation /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:1593:10
#22 0x7f9875dee145 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:2806:12
#23 0x7f9875ddfe22 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:451:13
#24 0x7f9875de08b8 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:605:13
#25 0x7f9875de1b6d in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:672:8
#26 0x7f9875ed3744 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:119:10
#27 0x7f987143f97b in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventHandlerBinding.cpp:65:37
#28 0x7f9871da5bc9 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget>>(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:82:12
#29 0x7f9871da4c97 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /builds/worker/checkouts/gecko/dom/events/JSEventHandler.cpp:199:12
#30 0x7f9871d81565 in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1348:22
#31 0x7f9871d82664 in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1663:12
#32 0x7f9871d81ed9 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1560:35
#33 0x7f9871d7561f in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:465:5
#34 0x7f9871d7561f in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:364:17
#35 0x7f9871d74b9b in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:611:18
#36 0x7f9871d775d6 in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1232:11
#37 0x7f9873f52042 in nsDocumentViewer::LoadComplete(nsresult) /builds/worker/checkouts/gecko/layout/base/nsDocumentViewer.cpp:1077:7
#38 0x7f98753c5d82 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:6329:13
#39 0x7f98753c518b in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:5721:7
#40 0x7f98753c6e56 in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp
#41 0x7f986f5f2359 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:1372:3
#42 0x7f986f5f18d2 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:978:14
#43 0x7f986f5efadb in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:795:9
#44 0x7f986f5f0d81 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:678:5
#45 0x7f98753fd3bf in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:13838:23
#46 0x7f986e80815f in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:631:22
#47 0x7f986e8096a0 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:535:10
#48 0x7f987023d2ac in mozilla::dom::Document::DoUnblockOnload() /builds/worker/checkouts/gecko/dom/base/Document.cpp:11688:18
#49 0x7f9870223276 in mozilla::dom::Document::DispatchContentLoadedEvents() /builds/worker/checkouts/gecko/dom/base/Document.cpp:8157:3
#50 0x7f98702d7199 in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1164:18
#51 0x7f98702d7199 in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
#52 0x7f98702d7199 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
#53 0x7f98702d7199 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
#54 0x7f98702d7199 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
#55 0x7f98702d7199 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1162:12
#56 0x7f98702d7199 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1213:13
#57 0x7f986e5c3c97 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:557:16
#58 0x7f986e5b98a3 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:884:26
#59 0x7f986e5b8097 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:707:15
#60 0x7f986e5b8515 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:493:36
#61 0x7f986e5c7c06 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:211:37
#62 0x7f986e5c7c06 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#63 0x7f986e5dcf32 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199:16
#64 0x7f986e5e405d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#65 0x7f986f2b4a05 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#66 0x7f986f1ce541 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#67 0x7f986f1ce541 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#68 0x7f9873acedb8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#69 0x7f9873b8bce8 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:470:33
#70 0x7f9875ba724b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:721:20
#71 0x7f986f2b58e6 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#72 0x7f986f1ce541 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#73 0x7f986f1ce541 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#74 0x7f9875ba6ab2 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:656:34
#75 0x55ba0f62bf76 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#76 0x55ba0f62bf76 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:375:18
#77 0x7f9883629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#78 0x7f9883629e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#79 0x55ba0f601ca8 in _start (/home/user/workspace/browsers/m-c-20231219152636-fuzzing-debug/firefox-bin+0x58ca8) (BuildId: 90d3f5cabd64731666bc1ea1e49f1b6315f5502c)
Flags: in-testsuite?

Can you attach the testcase?

Flags: needinfo?(twsmith)
Attached file testcase.html —

Good catch, thanks :)

Flags: needinfo?(twsmith)

Verified bug as reproducible on mozilla-central 20231220041048-8d4d791bc8d8.
The bug appears to have been introduced in the following build range:

Start: 639c0da2250e38bb3102b66c6105aaf808e2a817 (20231018160439)
End: 13cc0076698685511e3fa7c0fa91b02675ff5baa (20231018141620)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=639c0da2250e38bb3102b66c6105aaf808e2a817&tochange=13cc0076698685511e3fa7c0fa91b02675ff5baa

Keywords: regression
Whiteboard: [bugmon:bisected,confirmed]

It seems that the lazy iframe loading causes unexpected situation for IMEStateManager.

Regressed by: 1622090

Set release status flags based on info from the regressing bug 1622090

:canadahonk, since you are the author of the regressor, bug 1622090, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

status-firefox121: --- → affected
status-firefox122: --- → affected
status-firefox-esr115: --- → unaffected
Flags: needinfo?(omedhurst)

Ack, do we want this fixed urgently or can/should it wait until after holidays/etc?

Firefox 122 | Regression Engineering Owner (REO)

Hi Oliver,

It looks like comment 6 has been effectively answered, as it is generally past the holidays now.

We are wondering if you will have time to look at this before the 122 release.

Thanks!

After a first ~hour look, at the assertion currentTextInputHandlingWidget is nullptr (so doesn't match textInputHandlingWidget).

Inside nsViewManager::GetRootWidget() it gets to the last line of the function and returns nullptr; so mRootView does exist, but it has no widget or parent. My guess is it is the iframe widget before being loaded so does not have any widget or parent of its own yet.

It looks like sFocusedPresContext is always set correctly internally, it always has a text input handling widget (not nullptr) when being set.

Something specifically caused by a focused lazy loading iframe's document having design mode set on (so I'm not worried about it causing tab crashes in the wild, probably). I'm not that familiar with the text widget code so I'll ask around (and clear my NI for now).

Flags: needinfo?(omedhurst)

When IME state is changed (mostly caused by focus move), widget needs to notify IME of focus/blur. Therefore, if there is a new path which creates widget later, it needs to notify IMEStateManager of fake focus-move. Otherwise, IME state won't be enabled/disabled properly.

Severity: -- → S3
Priority: -- → P2
Priority: P2 → P3

Oh, I misunderstood this bug.

Although a puppet widget is created at very first state of BrowserChild creation. So, I don't know why it's not accessible from nsPresContext... However, IMEStateManager::UpdateIMEState relaxes about the situation:

#ifdef DEBUG
  {
    nsCOMPtr<nsIWidget> currentTextInputHandlingWidget =
        sFocusedPresContext->GetTextInputHandlingWidget();
    MOZ_ASSERT(!currentTextInputHandlingWidget ||
               currentTextInputHandlingWidget == textInputHandlingWidget);
  }
#endif  // DEBUG

This assertion came from bug 1342552, but I don't remember the detail, and I was struggling with the complicated management of the view and the view manager.

I guess that it's enough to make IMEStateManager::CreateIMEContentObserver use MOZ_ASSERT_IF(currentTextInputHandlingWidget, currentTextInputHandlingWidget == textInputHandlingWidget) instead and need to change all sFocusedPresContext->GetTextInputHandlingWidget() callers to use sFocusedPresContext and need to add an accessor for it for EditorEventListner.

Oh, even if I fix the assertion failure, the <iframe> does not correctly become editable. I'll file a bug.

Assignee: nobody → masayuki
Status: NEW → ASSIGNED
status-firefox121: fix-optional → wontfix
status-firefox122: fix-optional → wontfix
OS: Unspecified → All
Hardware: Unspecified → All

If given nsPresContext is for a lazy loading <iframe> and the frame has not
been loaded yet, it may return nullptr. However,
BrowserParent::GetTextInputHandlingWidget() may have it and it may be cached
with IMEStateManager::sTextInputHandlingWidget. Therefore, IMEStateManager
should use:

  • sTextInputHandlingWidget if it's available
  • BrowserParent if it's available
  • nsPresContext if it's available
Pushed by masayuki@d-toybox.com:
https://hg.mozilla.org/integration/autoland/rev/31553d8836d3
Make `IMEStateManager` stop using `nsPresContext::GetTextInputHandlingWidget()` as far as possible r=smaug
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/44010 for changes under testing/web-platform/tests
Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed], [wptsync upstream]

https://hg.mozilla.org/mozilla-central/rev/31553d8836d3

Status: ASSIGNED → RESOLVED
Closed: 5 months ago
status-firefox123: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 123 Branch

Verified bug as fixed on rev mozilla-central 20240116050321-02d1a62ad90a.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
status-firefox123: fixed → verified
Keywords: bugmon
Upstream PR merged by moz-wptsync-bot
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: