Closed Bug 1908239 Opened 3 months ago Closed 3 months ago

Assertion failure: EditorUtils::IsEditableContent(*leafContent->GetParent(), EditorType::HTML), at /editor/libeditor/HTMLEditor.cpp:1161

Categories

(Core :: DOM: Editor, defect)

Product:
Core
Component:
DOM: Editor
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
130 Branch
Tracking Flags:
Tracking Status
firefox-esr115 --- unaffected
firefox-esr128 --- unaffected
firefox128 --- unaffected
firefox129 --- unaffected
firefox130 --- verified

People

(Reporter: jkratzer, Assigned: masayuki)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: regression, testcase, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])

Attachments

(2 files)

Testcase
460 bytes, text/html
Details
Bug 1908239 - Make `HTMLEditor::FocusedElementOrDocumentBecomesNotEditable` set `HTMLEditor::mIsInDesignMode` r=m_kato!
48 bytes, text/x-phabricator-request
Details | Review

Testcase found while fuzzing mozilla-central rev 2ed6b77c66d3 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch --build 2ed6b77c66d3 --debug --fuzzing  -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: EditorUtils::IsEditableContent(*leafContent->GetParent(), EditorType::HTML), at /editor/libeditor/HTMLEditor.cpp:1161

    ==269681==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7a63a1b7b8b4 bp 0x7ffe9a010140 sp 0x7ffe9a010080 T269681)
    ==269681==The signal is caused by a WRITE memory access.
    ==269681==Hint: address points to the zero page.
        #0 0x7a63a1b7b8b4 in mozilla::HTMLEditor::MaybeCollapseSelectionAtFirstEditableNode(bool) const /editor/libeditor/HTMLEditor.cpp:1160:7
        #1 0x7a63a1b8c8be in mozilla::HTMLEditor::NotifyRootChanged() /editor/libeditor/HTMLEditor.cpp:7147:8
        #2 0x7a639c446a46 in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18
        #3 0x7a639c446a46 in __invoke_impl<nsresult, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
        #4 0x7a639c446a46 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
        #5 0x7a639c446a46 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
        #6 0x7a639c446a46 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
        #7 0x7a639c446a46 in apply<nsIThread, nsresult (nsIThread::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12
        #8 0x7a639c446a46 in mozilla::detail::RunnableMethodImpl<nsUpdateProcessor*, void (nsUpdateProcessor::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13
        #9 0x7a639e2b64fe in nsContentUtils::RemoveScriptBlocker() /dom/base/nsContentUtils.cpp:6258:17
        #10 0x7a639e5114d5 in mozilla::dom::Document::EndUpdate() /dom/base/Document.cpp:8115:3
        #11 0x7a639e581b3f in ~mozAutoDocUpdate /dom/base/mozAutoDocUpdate.h:34:18
        #12 0x7a639e581b3f in mozilla::dom::FragmentOrElement::SetInnerHTMLInternal(nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /dom/base/FragmentOrElement.cpp:2008:1
        #13 0x7a639f53b83d in mozilla::dom::Element_Binding::set_innerHTML(JSContext*, JS::Handle<JSObject*>, void*, JSJitSetterCallArgs) /builds/worker/workspace/obj-build/dom/bindings/./ElementBinding.cpp:4506:24
        #14 0x7a639f757c5c in bool mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::NormalThisPolicy>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3216:8
        #15 0x7a63a2ae0064 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:491:13
        #16 0x7a63a2adf84f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:585:12
        #17 0x7a63a2ae0e4f in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:684:8
        #18 0x7a63a2ae20e4 in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /js/src/vm/Interpreter.cpp:815:10
        #19 0x7a63a2d36a4a in SetExistingProperty(JSContext*, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<js::NativeObject*>, js::PropertyResult const&, JS::ObjectOpResult&) /js/src/vm/NativeObject.cpp:2667:8
        #20 0x7a63a2d3595d in bool js::NativeSetProperty<(js::QualifiedBool)1>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /js/src/vm/NativeObject.cpp:2701:14
        #21 0x7a63a2aed614 in SetObjectElementOperation /js/src/vm/Interpreter.cpp:1625:10
        #22 0x7a63a2aed614 in js::Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3109:12
        #23 0x7a63a2adef96 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:463:13
        #24 0x7a63a2adf948 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:617:13
        #25 0x7a63a2ae0e4f in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:684:8
        #26 0x7a63a2be5127 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:119:10
        #27 0x7a639f4ca672 in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventListenerBinding.cpp:62:8
        #28 0x7a639fd192e6 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:65:12
        #29 0x7a639fd18e49 in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /dom/events/EventListenerManager.cpp:1339:43
        #30 0x7a639fd19f94 in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /dom/events/EventListenerManager.cpp:1662:12
        #31 0x7a639fd19809 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /dom/events/EventListenerManager.cpp:1559:35
        #32 0x7a639fd0d7cf in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:365:17
        #33 0x7a639fd0ce41 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:606:16
        #34 0x7a639fd0f71f in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /dom/events/EventDispatcher.cpp:1221:11
        #35 0x7a639fd12963 in mozilla::EventDispatcher::DispatchDOMEvent(mozilla::dom::EventTarget*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /dom/events/EventDispatcher.cpp
        #36 0x7a639e7b6d2c in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /dom/base/nsINode.cpp:1444:17
        #37 0x7a639e2aae9c in nsContentUtils::DispatchEvent(mozilla::dom::Document*, mozilla::dom::EventTarget*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch) /dom/base/nsContentUtils.cpp:4876:29
        #38 0x7a639e2aad02 in nsContentUtils::DispatchTrustedEvent(mozilla::dom::Document*, mozilla::dom::EventTarget*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*) /dom/base/nsContentUtils.cpp:4842:10
        #39 0x7a639e511db5 in mozilla::dom::Document::DispatchContentLoadedEvents() /dom/base/Document.cpp:8200:3
        #40 0x7a639e5cad99 in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18
        #41 0x7a639e5cad99 in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
        #42 0x7a639e5cad99 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
        #43 0x7a639e5cad99 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
        #44 0x7a639e5cad99 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
        #45 0x7a639e5cad99 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12
        #46 0x7a639e5cad99 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13
        #47 0x7a639c709317 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:618:16
        #48 0x7a639c6feda6 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:945:26
        #49 0x7a639c6fd7b7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:768:15
        #50 0x7a639c6fdc35 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:554:36
        #51 0x7a639c70cc76 in operator() /xpcom/threads/TaskController.cpp:268:37
        #52 0x7a639c70cc76 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /xpcom/threads/nsThreadUtils.h:548:5
        #53 0x7a639c72061d in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1204:16
        #54 0x7a639c7272ff in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:480:10
        #55 0x7a639d282a25 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #56 0x7a639d1d9801 in RunHandler /ipc/chromium/src/base/message_loop.cc:363:3
        #57 0x7a639d1d9801 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:345:3
        #58 0x7a63a19c79c8 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:148:27
        #59 0x7a63a1a807e4 in nsAppShell::Run() /widget/gtk/nsAppShell.cpp:469:33
        #60 0x7a63a2938aab in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:714:20
        #61 0x7a639d283876 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #62 0x7a639d1d9801 in RunHandler /ipc/chromium/src/base/message_loop.cc:363:3
        #63 0x7a639d1d9801 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:345:3
        #64 0x7a63a293833b in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:649:34
        #65 0x58af2d149d9f in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #66 0x58af2d149d9f in main /browser/app/nsBrowserApp.cpp:378:18
        #67 0x7a63ab1afd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #68 0x7a63ab1afe3f in __libc_start_main csu/../csu/libc-start.c:392:3
        #69 0x58af2d11f7d8 in _start (/home/jkratzer/builds/m-c-20240716040830-fuzzing-debug/firefox-bin+0x587d8) (BuildId: d044bb35ba0712d970cba49452c75840e6e32906)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /editor/libeditor/HTMLEditor.cpp:1160:7 in mozilla::HTMLEditor::MaybeCollapseSelectionAtFirstEditableNode(bool) const
    ==269681==ABORTING
Attached file Testcase —
Severity: -- → S3

Verified bug as reproducible on mozilla-central 20240716214815-41f5f11a27e6.
The bug appears to have been introduced in the following build range:

Start: ae67a0e098b4518b9760482c91ef32871a0153d7 (20240712095045)
End: 336d18e0fd55f78b598e776eea6a6de597f0392a (20240712090038)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ae67a0e098b4518b9760482c91ef32871a0153d7&tochange=336d18e0fd55f78b598e776eea6a6de597f0392a

Keywords: regression
Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]
Attachment #9413099 - Attachment mime type: application/octet-stream → text/html

Okay, the caller should stop calling it if the editing host is replaced with non-editable element. This should not affect to users at least visually.

Assignee: nobody → masayuki
Status: NEW → ASSIGNED

Based on comment #2, this bug contains a bisection range found by bugmon. However, the Regressed by field is still not filled.

:masayuki, if possible, could you fill the Regressed by field and investigate this regression?

For more information, please visit BugBot documentation.

Flags: needinfo?(masayuki)

Well, bug 1798379 improved the focus handling of HTMLEditor when the editing state is changed. So, that caused that the test can run after document.designMode = "off" or style.setAttribute("contenteditable", true).

Flags: needinfo?(masayuki)
Regressed by: 1798379

Set release status flags based on info from the regressing bug 1798379

status-firefox128: --- → unaffected
status-firefox129: --- → unaffected
status-firefox130: --- → affected
status-firefox-esr115: --- → unaffected
status-firefox-esr128: --- → unaffected

Ah, this simply detected a bug of my patch for bug 1798379!

This is a simple mistake, it does not reset mIsInDesignMode when it emulates
a "blur".

Additionally, I realized that it does not check whether the focused element is
in the document or not and emulates "focus" of itself it the focused element is
in a different document. In such case, the editor shouldn't have focus, so,
this is a hidden bug, but "blur" notification may occur asynchronously.
Therefore, this could be a bug only in some edge cases.

Pushed by masayuki@d-toybox.com: https://hg.mozilla.org/integration/autoland/rev/f26eadd37a81 Make `HTMLEditor::FocusedElementOrDocumentBecomesNotEditable` set `HTMLEditor::mIsInDesignMode` r=m_kato
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/47230 for changes under testing/web-platform/tests
Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed], [wptsync upstream]

https://hg.mozilla.org/mozilla-central/rev/f26eadd37a81

Status: ASSIGNED → RESOLVED
Closed: 3 months ago
status-firefox130: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 130 Branch
Upstream PR merged by moz-wptsync-bot

Verified bug as fixed on rev mozilla-central 20240722214643-ac4a1f84adfa.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
status-firefox130: fixed → verified
Keywords: bugmon
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: