1966135 - Hang on Reddit after dragging selected text

Status: VERIFIED FIXED

(Core :: DOM: Selection, defect)

Description

[Andrew McCreight [:mccr8]]

STR:

1. Go to a Reddit comment page like https://www.reddit.com/r/news/comments/1klnsb2/microsoft_is_cutting_3_of_all_workers/
2. Select the text of a comment.
3. Click and drag the highlighted text.

Results: the content process hangs. Here's a profile: https://share.firefox.dev/44Avepx

I think this is a regression. Sean, could this be a regression from bug 1932150? I can do a bisection if it doesn't seem like that's the problem.

I'm on the latest 2025-05-13 Nightly.

[Tracking Requested - why for this release]: Fairly easy to trigger hang that makes a popular page unusable.

Comment 1

[Andrew McCreight [:mccr8]]

I did a mozregression. Here's the resulting range.

Comment 2

[Sean Feng [:sefeng211]]

Attachment: WIP: Bug 1966135

Comment 3

[BugBot [:suhaib / :marco]]

The bug is marked as tracked for firefox140 (nightly). We have limited time to fix this, the soft freeze is in 8 days. However, the bug still isn't assigned.

:hsinyi, could you please find an assignee for this tracked bug? Given that it is a regression and we know the cause, we could also simply backout the regressor. If you disagree with the tracking decision, please talk with the release managers.

For more information, please visit BugBot documentation.

Comment 4

[Andrew McCreight [:mccr8]]

Looks like sefeng is working on this so I'll assign it to them.

Comment 5

[Sean Feng [:sefeng211]]

Attachment: Bug 1966135 - Make CompareToRange{Start|End} explicit about the ordering

Comment 6

[Sean Feng [:sefeng211]]

Attachment: Bug 1966135 - Allow CompareChildOffsetAndChildNode to do flattened tree comparison

If the element is slotted and the aKind == TreeKind::Flat, it should
use the index of AssignedNodes of the slot element to do the
comparison.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e4002275827f
Make CompareToRange{Start|End} explicit about the ordering r=jjaschke,dom-core
https://hg.mozilla.org/integration/autoland/rev/39ef68bec9f9
Allow CompareChildOffsetAndChildNode to do flattened tree comparison r=jjaschke,dom-core

Comment 9

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/e4002275827f
https://hg.mozilla.org/mozilla-central/rev/39ef68bec9f9

Comment 10

[Monica Chiorean]

I was able to reproduce the issue on Ubuntu 24.04 using Firefox build 140.0a1(20250513214736).
Verified as fixed on Win11 / Ubuntu 24.04 using Firefox builds 141.0a1 and 140.0b2.