1950272 - Crash in [@ mozilla::ContentIteratorBase<T>::InitWithoutValidatingPoints] . MOZ_DIAGNOSTIC_ASSERT(RangeUtils::IsValidPoints(aStart, aEnd)) . STR in comment #10

Status: NEW

(Core :: DOM: Core & HTML, defect)

Description

[Mayank Bansal]

Crash report: https://crash-stats.mozilla.org/report/index/308fc5dd-ca3d-4ef5-9392-c8e520250225

MOZ_CRASH Reason:

MOZ_DIAGNOSTIC_ASSERT(RangeUtils::IsValidPoints(aStart, aEnd))

Top 10 frames:

0  xul.dll  mozilla::ContentIteratorBase<nsINode*>::InitWithoutValidatingPoints(mozilla::...  dom/base/ContentIterator.cpp:255
1  xul.dll  mozilla::dom::TextDirectiveUtil::NormalizedRangeBoundariesAreEqual(mozilla::R...  dom/base/TextDirectiveUtil.cpp:482
2  xul.dll  mozilla::dom::TextDirectiveCreator::FindAllMatchingRanges(nsTString<char16_t>...  dom/base/TextDirectiveCreator.cpp:910
3  xul.dll  mozilla::dom::TextDirectiveCreator::FindAllMatchingCandidates()  dom/base/TextDirectiveCreator.cpp:803
4  xul.dll  mozilla::dom::TextDirectiveCreator::CreateTextDirectiveFromRange(mozilla::dom...  dom/base/TextDirectiveCreator.cpp:785
5  xul.dll  mozilla::dom::FragmentDirective::CreateTextDirective(nsRange&)  dom/base/FragmentDirective.cpp:445
6  xul.dll  mozilla::dom::FragmentDirective_Binding::createTextDirective(JSContext*, JS::...  dom/bindings/FragmentDirectiveBinding.cpp:163
6  xul.dll  mozilla::dom::FragmentDirective_Binding::createTextDirective_promiseWrapper(J...  dom/bindings/FragmentDirectiveBinding.cpp:174
7  xul.dll  mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::Nor...  dom/bindings/BindingUtils.cpp:3302
8  xul.dll  CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::...  js/src/vm/Interpreter.cpp:493

I have the text-fragment pref enabled.
I had opened https://treeherder.mozilla.org/jobs?repo=try and had maybe double-clicked some text

Comment 1

[Mayank Bansal]

Havent been able to repro.

Comment 2

[Mayank Bansal]

Attachment: about:support

Comment 3

[Mayank Bansal]

OK, got the STR.
Create new profile.
Enable text-fragment thingy (i.e. dom.text_fragments.create_text_fragment.enabled = TRUE)
restart firefox
Go to reddit.com (you would be logged out as this is a new Firefox profile)
Select all the text by doing a CTRL + A
Right click on any selected text

AR: Crash.
https://crash-stats.mozilla.org/report/index/3e4dd708-38eb-4c25-b715-c04ad0250225

Comment 4

[Mayank Bansal]

Attachment: crash on reddit.mp4

Comment 5

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(sickish, maybe slower respose)]

I don't know about the classes in the stack, maybe Jan know them.

Comment 6

[Jan Jaeschke [:jjaschke]]

I'll take a look. I have to rewrite some logic there anyway, I'll try and ensure that this crash is gone then as well.

Comment 7

[Mayank Bansal]

Also occurs on twitter page like this: https://x.com/pcwalton

Comment 8

[Mayank Bansal]

And on wiki : https://en.wikipedia.org/wiki/Barack_Obama

Comment 9

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(sickish, maybe slower respose)]

Currently, this is not reproducible within the default settings, so I mark this as S3 for now.

Comment 10

[Mayank Bansal]

Much easier repro:

1. Open about:addons
2. Select all the text be doing CTRL + A
3. Right click on any selected text
4. Insta full-browser crash.