Closed Bug 1872300 Opened 2 years ago Closed 2 years ago

Assertion failure: index >= 0, at /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:5356

Categories

(Core :: DOM: UI Events & Focus Handling, defect)

Product:
Core
Component:
DOM: UI Events & Focus Handling
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
131 Branch
Tracking Flags:
Tracking Status
firefox-esr115 --- wontfix
firefox-esr128 --- wontfix
firefox123 --- wontfix
firefox124 --- wontfix
firefox125 --- wontfix
firefox129 --- wontfix
firefox130 --- wontfix
firefox131 --- verified

People

(Reporter: tsmith, Assigned: masayuki)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [bugmon:confirmed,bisected], [wptsync upstream])

Attachments

(1 file, 1 external file, 1 obsolete file)

testcase.html
192 bytes, text/html
Details
Attached file testcase.html (obsolete) —

Found while fuzzing m-c 20231227-856e86584c4c (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: index >= 0, at /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:5356

#0 0x7fb8f7c73608 in GetRangeForFrame(nsIFrame const*) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:5356:3
#1 0x7fb8f7c7cad2 in nsIFrame::PeekOffset(mozilla::PeekOffsetStruct*) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:9354:41
#2 0x7fb8f7b83379 in mozilla::SelectionMovementUtils::GetCaretFrameForNodeOffset(nsFrameSelection const*, nsIContent*, unsigned int, mozilla::CaretAssociationHint, mozilla::intl::BidiEmbeddingLevel, mozilla::ForceEditableRegion) /builds/worker/checkouts/gecko/layout/generic/SelectionMovementUtils.cpp
#3 0x7fb8f7af6d15 in nsCaret::GetFrameAndOffset(mozilla::dom::Selection const*, nsINode*, int, int*, nsIFrame**) /builds/worker/checkouts/gecko/layout/base/nsCaret.cpp:366:7
#4 0x7fb8f7af8002 in SchedulePaint /builds/worker/checkouts/gecko/layout/base/nsCaret.cpp:409:21
#5 0x7fb8f7af8002 in nsCaret::SetIgnoreUserModify(bool) /builds/worker/checkouts/gecko/layout/base/nsCaret.cpp:765:3
#6 0x7fb8f77b6452 in mozilla::EditorBase::FinalizeSelection() /builds/worker/checkouts/gecko/editor/libeditor/EditorBase.cpp:5510:12
#7 0x7fb8f3ff2426 in nsFocusManager::ContentRemoved(mozilla::dom::Document*, nsIContent*) /builds/worker/checkouts/gecko/dom/base/nsFocusManager.cpp:924:23
#8 0x7fb8f58b4279 in mozilla::EventStateManager::ContentRemoved(mozilla::dom::Document*, nsIContent*) /builds/worker/checkouts/gecko/dom/events/EventStateManager.cpp:6060:9
#9 0x7fb8f7a82c6b in mozilla::PresShell::ContentRemoved(nsIContent*, nsIContent*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4547:38
#10 0x7fb8f3eb9bc7 in operator() /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:188:19
#11 0x7fb8f3eb9bc7 in Notify<(NotifyPresShell)1, (lambda at /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:188:19)> /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:91:7
#12 0x7fb8f3eb9bc7 in mozilla::dom::MutationObservers::NotifyContentRemoved(nsINode*, nsIContent*, nsIContent*) /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:187:3
#13 0x7fb8f4052511 in nsINode::RemoveChildNode(nsIContent*, bool) /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:2231:5
#14 0x7fb8f4054b8c in nsINode::ReplaceOrInsertBefore(bool, nsINode*, nsINode*, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:2760:5
#15 0x7fb8f5c7451b in ReplaceChild /builds/worker/checkouts/gecko/dom/base/nsINode.h:2166:12
#16 0x7fb8f5c7451b in nsGenericHTMLElement::SetOuterText(nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/html/nsGenericHTMLElement.cpp:3251:11
#17 0x7fb8f51ac54b in mozilla::dom::HTMLElement_Binding::set_outerText(JSContext*, JS::Handle<JSObject*>, void*, JSJitSetterCallArgs) /builds/worker/workspace/obj-build/dom/bindings/./HTMLElementBinding.cpp:490:24
#18 0x7fb8f5294aaa in bool mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::NormalThisPolicy>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3206:8
#19 0x7fb8f97a78b4 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:479:13
#20 0x7fb8f97a720b in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:573:12
#21 0x7fb8f97a84dd in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:672:8
#22 0x7fb8f97a97b4 in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:803:10
#23 0x7fb8f9a0f960 in SetExistingProperty(JSContext*, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<js::NativeObject*>, js::PropertyResult const&, JS::ObjectOpResult&) /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2593:8
#24 0x7fb8f9a0e975 in bool js::NativeSetProperty<(js::QualifiedBool)1>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2627:14
#25 0x7fb8f97b4ab5 in SetObjectElementOperation /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:1593:10
#26 0x7fb8f97b4ab5 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:2806:12
#27 0x7fb8f97a6792 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:451:13
#28 0x7fb8f97a7228 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:605:13
#29 0x7fb8f97a84dd in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:672:8
#30 0x7fb8f989a4f4 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:119:10
#31 0x7fb8f4fcf41c in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventListenerBinding.cpp:62:8
#32 0x7fb8f590ce96 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:65:12
#33 0x7fb8f590ca52 in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1342:43
#34 0x7fb8f590db94 in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1663:12
#35 0x7fb8f590d409 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1560:35
#36 0x7fb8f5900b2f in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:465:5
#37 0x7fb8f5900b2f in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:364:17
#38 0x7fb8f59000ab in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:611:18
#39 0x7fb8f5902ae6 in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1232:11
#40 0x7fb8f5905e96 in mozilla::EventDispatcher::DispatchDOMEvent(mozilla::dom::EventTarget*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp
#41 0x7fb8f404b409 in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:1404:17
#42 0x7fb8f3b3fc5c in nsContentUtils::DispatchEvent(mozilla::dom::Document*, mozilla::dom::EventTarget*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch) /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:4756:29
#43 0x7fb8f3b3fac2 in nsContentUtils::DispatchTrustedEvent(mozilla::dom::Document*, mozilla::dom::EventTarget*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*) /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:4722:10
#44 0x7fb8f3da6c25 in mozilla::dom::Document::DispatchContentLoadedEvents() /builds/worker/checkouts/gecko/dom/base/Document.cpp:8069:3
#45 0x7fb8f3e5af39 in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1164:18
#46 0x7fb8f3e5af39 in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
#47 0x7fb8f3e5af39 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
#48 0x7fb8f3e5af39 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
#49 0x7fb8f3e5af39 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
#50 0x7fb8f3e5af39 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1162:12
#51 0x7fb8f3e5af39 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1213:13
#52 0x7fb8f21462d7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:568:16
#53 0x7fb8f213ba46 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:895:26
#54 0x7fb8f213a227 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:718:15
#55 0x7fb8f213a6a5 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:504:36
#56 0x7fb8f214a276 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:222:37
#57 0x7fb8f214a276 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#58 0x7fb8f215f5e2 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199:16
#59 0x7fb8f216672d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#60 0x7fb8f2e39885 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#61 0x7fb8f2d53351 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#62 0x7fb8f2d53351 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#63 0x7fb8f767d488 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#64 0x7fb8f773a458 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:470:33
#65 0x7fb8f956db7b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:721:20
#66 0x7fb8f2e3a766 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#67 0x7fb8f2d53351 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#68 0x7fb8f2d53351 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#69 0x7fb8f956d3e2 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:656:34
#70 0x5574097b2156 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#71 0x5574097b2156 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:375:18
#72 0x7fb906a29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#73 0x7fb906a29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#74 0x557409787e88 in _start (/home/user/workspace/browsers/m-c-20231228170344-fuzzing-debug/firefox-bin+0x58e88) (BuildId: 7361de96fa77a97dae318edc8ce497bdf446c925)

Verified bug as reproducible on mozilla-central 20231228170344-10aa74237898.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: 3aeca13c7e9eafad7c808e12cdc14818097d03a6 (20221230044034)
End: 856e86584c4c811f064f93e2b734dd374c787eaf (20231227205835)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Whiteboard: [bugmon:bisected,confirmed]

Sean, maybe you'd want to take a look at this along with your shadow dom selection work. The comment in the code hints it's shadow dom related.

Flags: needinfo?(sefeng)

I think this is more like a bug in the editor where the keygen element is being removed from the document (by setting outerText), but Caret code still think it's the focused node.

I am not sure if this is a editor bug, selection bug or caret bug...Masayuki, thoughts on this?

Flags: needinfo?(sefeng) → needinfo?(masayuki)

I think that nsCaret::SchedulePaint uses Selection in this case because mOverrideContent is used for DnD. If so, I guess that PresShell::ContentRemoved is called before the mutation observer of nsRange instances.

I think that nsCaret::GetFrameAndOffset should check whether the target content is connected or not. If not connected, it should do nothing. Then, the mutation observer of nsRange will update itself, then, Selection will notify listeners of a change. Then, nsCaret::NotifySelectionChanged is called and a paint will be scheduled.

Flags: needinfo?(masayuki)

Comment 4 seems to point to layout for this bug. Feel free to send it back if that's not correct.

Component: DOM: Selection → Layout
Severity: -- → S3

Testcase crashes using the initial build (mozilla-central 20231227205835-856e86584c4c) but not with tip (mozilla-central 20240223210323-48ac42d415d3.)

The bug appears to have been fixed in the following build range:

Start: 61cb2b6b27f57fbb945c3b3613bf7c458ff4abf4 (20240222103314)
End: 836800665817ebbf328952caef8477f135630733 (20240222085843)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=61cb2b6b27f57fbb945c3b3613bf7c458ff4abf4&tochange=836800665817ebbf328952caef8477f135630733

tsmith, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Flags: needinfo?(twsmith)
Keywords: bugmon

Masayuki: could this have been fixed by your patch for bug 1880710 (Make HTMLEditor::IsEmpty check whether the editing host is empty)? Seems the most likely check-in from the range in comment 6.

Flags: needinfo?(masayuki)
Flags: needinfo?(twsmith)

I think that the fix of bug 1880710 just hides the bug. Before the fix, editor tries to delete something in <keygen contenteditable> because HTMLEditor::IsEmpty() returned false due to non-empty <body>. However, after the fix, editor does nothing because <keygen contenteditable> is empty.

Anyway, let's add the test case into the tree. I guess that tsmith would find another test case for the root cause.

Assignee: nobody → masayuki
Status: NEW → ASSIGNED
Flags: needinfo?(masayuki)

The fuzzers are still reporting this, I'll add a new test case once the reducer is complete.

Flags: needinfo?(twsmith)

Thank you, then, let's wait the new test.

Assignee: masayuki → nobody
Status: ASSIGNED → NEW
Attached file testcase.html —
Attachment #9370451 - Attachment is obsolete: true
Flags: needinfo?(twsmith)
status-firefox123: affected → wontfix
status-firefox125: --- → affected
Keywords: bugmon
Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisect,confirmed]

Since nightly and release are affected, beta will likely be affected too.
For more information, please visit BugBot documentation.

status-firefox124: --- → affected

Unable to bisect testcase (Testcase reproduces on start build!):

Start: 0ad4a636de7bf9e3cba84d70b3d014133792b246 (20230313153729)
End: 856e86584c4c811f064f93e2b734dd374c787eaf (20231227205835)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Whiteboard: [bugmon:bisect,confirmed] → [bugmon:confirmed,bisected]

A new testcase has been added as requested in comment #10

Flags: needinfo?(masayuki)

Thank you! However, unfortunately, I don't have much time to work on this soon...

Okay, I had spare time today and I succeeded to write a patch for this. I'll request review for it after checking the tryserver result.

The root cause is nsFocusManager::ContentRemoved calls HTMLEditor::FinalizeSelection while the editing host is being removed. Therefore, I change the component.

Assignee: nobody → masayuki
Status: NEW → ASSIGNED
Component: Layout → DOM: UI Events & Focus Handling
Flags: needinfo?(masayuki)
OS: Unspecified → All
Hardware: Unspecified → All

HTMLEditor::FinalizeSelection() resets the caret and nsCaret schedules to
paint itself with the new state. If editing host is being removed, it's already
been removed from the child chain of its parent but it still knows the parent.
Additionally, nsCaret may still keep storing the removing editing host as the
content. In such case, we try to look for the line edge from the removing
editing host and fails to compute the index in its parent node for considering
the caret geometry. For avoiding to compute it in the unstable period,
nsFocusManager::ContentRemoved() should call HTMLEditor::FinalizeSelection()
after the removal ends.

Pushed by masayuki@d-toybox.com: https://hg.mozilla.org/integration/autoland/rev/4d5a61f391ae Make `nsFocusManager::ContentRemoved()` call `HTMLEditor::FinalizeSelection()` after the removal ends r=emilio
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/47773 for changes under testing/web-platform/tests
Whiteboard: [bugmon:confirmed,bisected] → [bugmon:confirmed,bisected], [wptsync upstream]

https://hg.mozilla.org/mozilla-central/rev/4d5a61f391ae

Status: ASSIGNED → RESOLVED
Closed: 2 years ago
status-firefox131: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 131 Branch

Verified bug as fixed on rev mozilla-central 20240824214259-4d5a61f391ae.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
status-firefox131: fixed → verified
Keywords: bugmon
Upstream PR merged by moz-wptsync-bot
Upstream PR merged by moz-wptsync-bot
Duplicate of this bug: 1848888
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: