1922153 - Assertion failure: startContent->IsInComposedDoc(), at /builds/worker/checkouts/gecko/dom/base/Selection.cpp:1909

Status: VERIFIED FIXED

(Core :: DOM: Selection, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20240913-b91e1b615932 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: startContent->IsInComposedDoc(), at /builds/worker/checkouts/gecko/dom/base/Selection.cpp:1909

#0 0x734fe7085ca6 in mozilla::dom::Selection::SelectFrames(nsPresContext*, mozilla::dom::AbstractRange&, bool) const /builds/worker/checkouts/gecko/dom/base/Selection.cpp:1909:3
#1 0x734fe7084e89 in mozilla::dom::Selection::Clear(nsPresContext*) /builds/worker/checkouts/gecko/dom/base/Selection.cpp:1449:5
#2 0x734fe707f755 in mozilla::dom::Selection::RemoveAllRangesInternal(mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Selection.cpp:2420:3
#3 0x734feb46c13d in nsWebBrowserFind::SearchInFrame(nsPIDOMWindowOuter*, bool, bool*) /builds/worker/checkouts/gecko/toolkit/components/find/nsWebBrowserFind.cpp:671:10
#4 0x734feb46b5e6 in nsWebBrowserFind::FindNext(bool*) /builds/worker/checkouts/gecko/toolkit/components/find/nsWebBrowserFind.cpp:106:8
#5 0x734fe6d8fb6e in nsGlobalWindowOuter::FindOuter(nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, bool, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:6450:20
#6 0x734fe6d403a5 in nsGlobalWindowInner::Find(nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, bool, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:4086:3
#7 0x734fe7ccdd2f in mozilla::dom::Window_Binding::find(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./WindowBinding.cpp:6375:36
#8 0x734fe81980b2 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3268:13
#9 0x734feb858ea4 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:528:13
#10 0x734feb85868f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:624:12
#11 0x734fec31b516 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jit/BaselineIC.cpp:1677:10
#12 0x1618ff4ffd5e  ([anon:js-executable-memory]+0x1bd5e)

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20241001155138-0546d4eb6429.
The bug appears to have been introduced in the following build range:

Start: 5969005dae85cc8ac486b2f0bdbb7454b660f252 (20240325134037)
End: 19dcff1ee3fcbb431110e0639c80a3ba51ee0a34 (20240325140555)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=5969005dae85cc8ac486b2f0bdbb7454b660f252&tochange=19dcff1ee3fcbb431110e0639c80a3ba51ee0a34

Comment 2

[Donal Meehan [:dmeehan - PTO - Back Oct 13]]

dom.shadowdom.selection_across_boundary.enabled is nightly only

Comment 3

[Sean Feng [:sefeng211]]

Thanks. I plan to revisit this bug after bug 1932150 is done.

Comment 4

[Mayank Bansal]

The testcase crashes for me on latest Win11x64 Nightly. Open the testcase and do a CTRL + A.
https://crash-stats.mozilla.org/report/index/7b4a3626-bf3e-43fc-88e6-b2b280250408

Comment 5

[Sean Feng [:sefeng211]]

Attachment: Bug 1922153 - Ensure CrossShadowBoundaryRange clears the boundaries when they are not in composed document anymore

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f343cad674d6
Ensure CrossShadowBoundaryRange clears the boundaries when they are not in composed document anymore r=jjaschke

Comment 7

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/f343cad674d6

Comment 8

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20250410092904-1ac598af5141.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.