1971401 - Assertion failure: mContent == mFrame->GetContent(), at /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:12767

Status: RESOLVED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Tyson Smith [:tsmith]]

Found with m-c 20250610-efc769b7a5f9 (--enable-debug)

This was found by visiting a live website with a debug build.

STR:

• Launch browser and visit site

This issue was triggered by visiting http://athleta.ca/. A Pernosco session is available here: https://pernos.co/debug/7d3U5pb6wxyjP35WITfGew/index.html

Assertion failure: mContent == mFrame->GetContent(), at /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:12767

0|0|libxul.so|mozilla::PresShell::EventHandler::EventTargetData::AssertIfEventTargetContentAndFrameContentMismatch(mozilla::WidgetGUIEvent const*) const|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|12767|0x233
0|1|libxul.so|mozilla::PresShell::EventHandler::DispatchPrecedingPointerEvent(AutoWeakFrame&, mozilla::WidgetGUIEvent*, mozilla::dom::Element*, bool, mozilla::PresShell::EventHandler::EventTargetData*, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|8125|0x2cf
0|2|libxul.so|mozilla::PresShell::EventHandler::HandleEventUsingCoordinates(AutoWeakFrame&, mozilla::WidgetGUIEvent*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|7711|0x1f6
0|3|libxul.so|mozilla::PresShell::EventHandler::HandleEvent(AutoWeakFrame&, mozilla::WidgetGUIEvent*, bool, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|7593|0x197
0|4|libxul.so|mozilla::PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|7422|0x48f
0|5|libxul.so|nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:view/nsViewManager.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|611|0x173
0|6|libxul.so|nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool)|hg:hg.mozilla.org/mozilla-central:view/nsView.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|983|0xc6
0|7|libxul.so|mozilla::widget::PuppetWidget::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&)|hg:hg.mozilla.org/mozilla-central:widget/PuppetWidget.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|311|0x1f3
0|8|libxul.so|mozilla::layers::APZCCallbackHelper::DispatchWidgetEvent(mozilla::WidgetGUIEvent&)|hg:hg.mozilla.org/mozilla-central:gfx/layers/apz/util/APZCCallbackHelper.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|538|0x37
0|9|libxul.so|mozilla::dom::BrowserChild::HandleRealMouseButtonEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&)|hg:hg.mozilla.org/mozilla-central:dom/ipc/BrowserChild.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|1722|0x295
0|10|libxul.so|mozilla::dom::BrowserChild::RecvRealMouseButtonEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&)|hg:hg.mozilla.org/mozilla-central:dom/ipc/BrowserChild.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|1675|0x1b
0|11|libxul.so|mozilla::dom::BrowserChild::RecvSynthMouseMoveEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&)|hg:hg.mozilla.org/mozilla-central:dom/ipc/BrowserChild.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|1633|0xd
0|12|libxul.so|mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:505325ac5852fd3a1db57eb05783baed8c4d26d5f503444e3aba0c521d0944c3c036a6f17549e7704e0768fe7193e32b9f92cd2f95b385f441b5bcbf54608071/ipc/ipdl/PBrowserChild.cpp:|5304|0x796f
0|13|libxul.so|mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:9742436618756ae0a4864b54f26afb54fd012e441cd565292045f35b0856c3ead5ecba0c1c339a4955777b8b030b19e37346c08f4709298f8aaef96f6a5f36a1/ipc/ipdl/PContentChild.cpp:|8398|0x60e
0|14|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|1795|0x128
0|15|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|1721|0x270
0|16|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|1512|0x178
0|17|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|1612|0xcd
0|18|libxul.so|mozilla::RunnableTask::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|703|0x17
0|19|libxul.so|mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|1310|0x50e
0|20|libxul.so|mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|1133|0x57
0|21|libxul.so|mozilla::TaskController::ProcessPendingMTTask(bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|639|0x65
0|22|libxul.so|mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|548|0x16
0|23|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|1159|0x5aa
0|24|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|480|0x4f
0|25|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|85|0xc0
0|26|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|344|0x61
0|27|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|148|0x28
0|28|libxul.so|nsAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/gtk/nsAppShell.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|471|0x114
0|29|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|652|0x6b
0|30|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|235|0x3c
0|31|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|344|0x61
0|32|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|590|0xae5
0|33|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:efc769b7a5f94b7b0912134e9aa9093ddb1b8657|397|0x1fe

Comment 1

[Daniel Holbert [:dholbert]]

This assertion was added in bug 1877815.

Just before the assertion-failure, pernosco shows this additional logging, which is meant to show the different content nodes:

[Child 17406, Main Thread] WARNING: mContent=area.map.div[class="relative w-full"].div[class="w-full"].div[class="absolute inset-0 transition-opacity"].div[class="relative mx-auto bg-white"].div.div['main-content'].div.div[class="relative"].main[class="font-brand"].body[class="at"].html.#document: file /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:12763

[Child 17406, Main Thread] WARNING: mFrame->GetContent()=img[class="w-full"].div[class="relative w-full"].div[class="w-full"].div[class="absolute inset-0 transition-opacity"].div[class="relative mx-auto bg-white"].div.div['main-content'].div.div[class="relative"].main[class="font-brand"].body[class="at"].html.#document: file /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:12766

Here, mContent is a HTMLAreaElement instance, while mFrame->GetContent() is a HTMLImageElement instance.

masayuki, maybe you could take a look here? I do see that https://phabricator.services.mozilla.com/D201053#6899401 mentioned a known area/img special case; it looks like this is a variant of that special case perhaps.

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 5/2-5/10)]

Well, sounds like just a bug of the assertion. I'll take a look once I'll be back.

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 5/2-5/10)]

Odd, I don't reproduce the assertion failure in the web site. However, it must be able to write a test. I'll try...

Comment 4

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 5/2-5/10)]

Attachment: Bug 1971401 - Make `EventTargetData::AssertIfEventTargetContentAndFrameContentMismatch()` handle `<area>` element in a specific path r=smaug!

Pointer/Mouse events in a link in an image map are targeted to the
<area> element, but the event target frame is the image frame.
Therefore, mContent == mFrame->GetContent() fails in this case (
mContent is the <area> and mFrame is the frame for <img>).

The assertion failure happens when DispatchPrecedingPointerEvent
is called with a pointer capturing element. Then, SetFrameAndContent
is called with the image frame and <area> element [1].

So, the assertion failure is just a bug of the assertion itself. It
should accept mFrame == mContent->GetPrimaryFrame() if mContent is
an <area> element.

1. https://searchfox.org/mozilla-central/rev/53acdf9ea724c7fc85cfc259e0acf7663f4d34b8/layout/base/PresShell.cpp#8232-8233

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/b1b5e90cbb80
https://hg.mozilla.org/integration/autoland/rev/549668599889
Make `EventTargetData::AssertIfEventTargetContentAndFrameContentMismatch()` handle `<area>` element in a specific path r=smaug

Comment 6

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/53531 for changes under testing/web-platform/tests

Comment 7

[amarc]

https://hg.mozilla.org/mozilla-central/rev/549668599889

Comment 8

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:masayuki, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox141 to wontfix.

For more information, please visit BugBot documentation.

Comment 10

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 5/2-5/10)]

It's a bug of the assertion, does not affect to users.