1907225 - Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Got HyperText CaretOffset but ToTextLeafPoint failed), at /builds/worker/checkouts/gecko/accessible/base/TextLeafRange.cpp:1019

Status: VERIFIED FIXED

(Core :: Disability Access APIs, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20240701-d88ebdb41052 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Got HyperText CaretOffset but ToTextLeafPoint failed), at /builds/worker/checkouts/gecko/accessible/base/TextLeafRange.cpp:1019

#0 0x7dc0f183ac92 in mozilla::a11y::TextLeafPoint::GetCaret(mozilla::a11y::Accessible*) /builds/worker/checkouts/gecko/accessible/base/TextLeafRange.cpp:1018:7
#1 0x7dc0f183a7ba in mozilla::a11y::SelectionManager::ProcessTextSelChangeEvent(mozilla::a11y::AccEvent*) /builds/worker/checkouts/gecko/accessible/base/SelectionManager.cpp:160:27
#2 0x7dc0f18293e9 in mozilla::a11y::EventQueue::ProcessEventQueue() /builds/worker/checkouts/gecko/accessible/base/EventQueue.cpp:392:23
#3 0x7dc0f1838c75 in mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) /builds/worker/checkouts/gecko/accessible/base/NotificationController.cpp:1014:3
#4 0x7dc0f1218b95 in nsRefreshDriver::TickObserverArray(unsigned int, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2518:10
#5 0x7dc0f121565a in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2761:8
#6 0x7dc0f121ea41 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:368:13
#7 0x7dc0f121ea41 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:346:7
#8 0x7dc0f121e940 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:362:5
#9 0x7dc0f121e7dd in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:952:5
#10 0x7dc0f121dacc in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:862:5
#11 0x7dc0f121ce59 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:593:14
#12 0x7dc0f069ad2b in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:66:15
#13 0x7dc0f0917577 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:222:78
#14 0x7dc0f084c040 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8168:32
#15 0x7dc0ec7473ef in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1820:25
#16 0x7dc0ec744142 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1739:9
#17 0x7dc0ec744dc2 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1530:3
#18 0x7dc0ec745f0f in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1630:14
#19 0x7dc0ebbd4437 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:580:16
#20 0x7dc0ebbc9ed6 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:907:26
#21 0x7dc0ebbc8907 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:730:15
#22 0x7dc0ebbc8d85 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:516:36
#23 0x7dc0ebbd7e36 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:234:37
#24 0x7dc0ebbd7e36 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#25 0x7dc0ebbeb4fd in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1204:16
#26 0x7dc0ebbf21df in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#27 0x7dc0ec74cf75 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#28 0x7dc0ec6a3c71 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#29 0x7dc0ec6a3c71 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#30 0x7dc0f0e917b8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#31 0x7dc0f0f4a5f4 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:469:33
#32 0x7dc0f1e021cb in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:714:20
#33 0x7dc0ec74ddc6 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#34 0x7dc0ec6a3c71 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#35 0x7dc0ec6a3c71 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#36 0x7dc0f1e01a5b in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:649:34
#37 0x5efb0a2c1c9f in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#38 0x5efb0a2c1c9f in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:378:18
#39 0x7dc0fa429d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#40 0x7dc0fa429e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#41 0x5efb0a2976d8 in _start (/home/user/workspace/browsers/m-c-20240710212209-fuzzing-debug/firefox-bin+0x586d8) (BuildId: 1082212a921342e8e7505cf61858bdf4a9520f98)

Comment 1

[Tyson Smith [:tsmith]]

Attachment: prefs.js

prefs.js for bugmon

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1905021

:Jamie, since you are the author of the regressor, bug 1905021, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20240711042720-be6b3324bc2c.
The bug appears to have been introduced in the following build range:

Start: a9f0952d79a4097d8d7f3daa05533fea8a74c8c9 (20240523205926)
End: f9e2e127fc8c5735405cf9aec6485dee02c29f90 (20240523135107)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a9f0952d79a4097d8d7f3daa05533fea8a74c8c9&tochange=f9e2e127fc8c5735405cf9aec6485dee02c29f90

Comment 4

[Donal Meehan [:dmeehan]]

:Jamie, next week is the final week of beta for Fx129.
Is there any user facing impact from this bug?
Do you plan on fixing this before the release?

Comment 5

[James Teh [:Jamie]]

There is no user facing bug. The code checks for this case and handles it gracefully. The assertion is just there because even though we protect against it, I don't understand why it happens in the first place and I'd like to get to the root cause eventually. I do not plan to fix this in the next few weeks.

Comment 6

[Tyson Smith [:tsmith]]

This has been detected via live site testing.

Comment 7

[James Teh [:Jamie]]

This may be fixed by bug 1948149, but I'm not certain.

Comment 8

[Tyson Smith [:tsmith]]

This is still reproducible and is reported frequently via fuzzers and live site testing.

Comment 9

[James Teh [:Jamie]]

Hmm. I'm quite surprised this wasn't fixed by bug 1948149. Back to the drawing board I guess. :(

Comment 10

[James Teh [:Jamie]]

Marking as s2 given this is now a fuzzblocker.

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

Since nightly and release are affected, beta will likely be affected too.
For more information, please visit BugBot documentation.

Comment 12

[James Teh [:Jamie]]

Distilled test case:
data:text/html,<div contenteditable id="editable" autofocus aria-hidden="true">abcd</div><p></p><script> window.getSelection().setBaseAndExtent(editable.firstChild, 3, editable.firstChild, 3); </script>

Comment 13

[James Teh [:Jamie]]

Attachment: Bug 1907225: HyperTextAccessible::DOMPointToOffset: If a text node doesn't have an Accessible, don't use an offset relative to that text node.

This was causing an assertion when firing caret events where the element containing the caret is aria-hidden, since the offset we produced was effectively bogus for the target Accessible.
Doing this is bad authoring, but we need to at least ensure the offset is valid.
Arguably, we shouldn't fire caret events at all in this case, but this is a trickier, riskier fix and I don't think it makes sense to spend time on that to compensate for bad authoring.

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c7d2b1f96d6b
HyperTextAccessible::DOMPointToOffset: If a text node doesn't have an Accessible, don't use an offset relative to that text node. r=eeejay

Comment 15

[amarc]

https://hg.mozilla.org/mozilla-central/rev/c7d2b1f96d6b

Comment 16

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20250314211155-1cdda4257383.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 17

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:Jamie, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox137 to wontfix.

For more information, please visit BugBot documentation.

Comment 18

[James Teh [:Jamie]]

Assertion that is only relevant to debug builds.