1978714 - Assertion failure: (aChild2 ? *aChild2->ComputeIndexInParentNode() : aParent.GetChildCount()) < (aChild1 ? *aChild1->ComputeIndexInParentNode() : aParent.GetChildCount()), at /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:3401

Status: VERIFIED FIXED

(Core :: DOM: Selection, defect)

Description

[Tyson Smith [:tsmith] (PTO -> Sept/8)]

Attachment: testcase.html

Found while fuzzing 20250522-68577999ef6b (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: (aChild2 ? *aChild2->ComputeIndexInParentNode() : aParent.GetChildCount()) < (aChild1 ? *aChild1->ComputeIndexInParentNode() : aParent.GetChildCount()), at /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:3401

#0 0x7fffe8db368c in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:248:3
#1 0x7fffe8db368c in mozilla::Maybe<int> nsContentUtils::CompareClosestCommonAncestorChildren<(TreeKind)2, void>(nsINode const&, nsINode const*, nsINode const*, nsContentUtils::ResizableNodeIndexCache<100ul>*) /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:3397:3
#2 0x7fffe8db2533 in mozilla::Maybe<int> nsContentUtils::ComparePointsWithIndices<(TreeKind)2, void>(nsINode const*, unsigned int, nsINode const*, unsigned int, nsContentUtils::ResizableNodeIndexCache<100ul>*) /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:3527:12
#3 0x7fffe92c7f75 in operator() /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:359:16
#4 0x7fffe92c7f75 in IsItemInRangeComparator::operator()(mozilla::dom::AbstractRange const*) const /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:367:26
#5 0x7fffe92c751f in nsINode::IsSelected(unsigned int, unsigned int, mozilla::dom::SelectionNodeCache*) const /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:440:20
#6 0x7fffed0b2d00 in nsTextFrame::IsFrameSelected() const /builds/worker/checkouts/gecko/layout/generic/nsTextFrame.cpp:7608:23
#7 0x7fffed2626c6 in IsSelected /builds/worker/checkouts/gecko/layout/generic/nsIFrame.h:4027:64
#8 0x7fffed2626c6 in mozilla::nsDisplayText::RenderToContext(gfxContext*, mozilla::nsDisplayListBuilder*, nsRect const&, float, bool) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:7756:19
#9 0x7fffed262edb in mozilla::nsDisplayText::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:7677:3
#10 0x7fffe8637326 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1860:41
#11 0x7fffe8635105 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:2119:7
#12 0x7fffed2554a1 in CreateWebRenderCommandsNewClipListOption /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:4617:30
#13 0x7fffed2554a1 in CreateWebRenderCommands /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.h:4953:12
#14 0x7fffed2554a1 in mozilla::nsDisplayOwnLayer::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:5257:22
#15 0x7fffe8637326 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1860:41
#16 0x7fffe8635105 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:2119:7
#17 0x7fffe863405a in mozilla::layers::WebRenderCommandBuilder::BuildWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, mozilla::layers::WebRenderScrollData&, WrFiltersHolder&&) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1781:5
#18 0x7fffe8649ac7 in mozilla::layers::WebRenderLayerManager::EndTransactionWithoutLayer(mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, WrFiltersHolder&&, mozilla::layers::WebRenderBackgroundData*, double, bool) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderLayerManager.cpp:365:30
#19 0x7fffed2449eb in mozilla::nsDisplayList::PaintRoot(mozilla::nsDisplayListBuilder*, gfxContext*, unsigned int, mozilla::Maybe<double>) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2301:18
#20 0x7fffecedb5cf in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:3252:9
#21 0x7fffece4d09d in mozilla::PresShell::PaintInternal(nsView*, mozilla::PaintInternalFlags) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:6714:5
#22 0x7fffec9cae4a in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /builds/worker/checkouts/gecko/view/nsViewManager.cpp:399:18
#23 0x7fffec9ca91e in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /builds/worker/checkouts/gecko/view/nsViewManager.cpp:334:22
#24 0x7fffec9cb9fc in nsViewManager::ProcessPendingUpdates() /builds/worker/checkouts/gecko/view/nsViewManager.cpp:784:5
#25 0x7fffece09d88 in nsRefreshDriver::PaintIfNeeded() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2607:9
#26 0x7fffece096c7 in operator() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2527:60
#27 0x7fffece096c7 in void nsRefreshDriver::RunRenderingPhaseLegacy<nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_13>(mozilla::RenderingPhase, nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_13&&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1287:3
#28 0x7fffece04512 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2525:3
#29 0x7fffece0dcf1 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:369:13
#30 0x7fffece0dcf1 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:347:7
#31 0x7fffece0dbf0 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:363:5
#32 0x7fffece0da9d in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:953:5
#33 0x7fffece0d03a in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:863:5
#34 0x7fffece0c536 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:594:14
#35 0x7fffec1ddbfb in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:66:15
#36 0x7fffec468e5d in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:235:78
#37 0x7fffe7d6e1fd in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:5173:32
#38 0x7fffe7d0d309 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1789:25
#39 0x7fffe7d0a502 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1716:9
#40 0x7fffe7d0b0e0 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1507:3
#41 0x7fffe7d0c1e9 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1607:14
#42 0x7fffe7145e57 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:703:16
#43 0x7fffe713f18e in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1252:20
#44 0x7fffe713dec7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1075:15
#45 0x7fffe713e345 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:639:36
#46 0x7fffe714cf26 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:333:37
#47 0x7fffe714cf26 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#48 0x7fffe715ef03 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1159:16
#49 0x7fffe716566f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#50 0x7fffe7d12d07 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#51 0x7fffe7c6bd71 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#52 0x7fffe7c6bd71 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#53 0x7fffeca30218 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#54 0x7fffecaf1ca4 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:471:33
#55 0x7fffeda31a5b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:652:20
#56 0x7fffe7d13bb4 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#57 0x7fffe7c6bd71 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#58 0x7fffe7c6bd71 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#59 0x7fffeda30e99 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:590:34
#60 0x5555555d76be in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:397:22

Comment 1

[Tyson Smith [:tsmith] (PTO -> Sept/8)]

This was also detected by live site testing.

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20250722162531-73304b4f70e7.
The bug appears to have been introduced in the following build range:

Start: 30b9bd7f6722f7d8458091be7d95f12b6245f9a1 (20250516143342)
End: 3b07ab6b33156283d65c6ff48abb0c38933bd486 (20250516160850)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=30b9bd7f6722f7d8458091be7d95f12b6245f9a1&tochange=3b07ab6b33156283d65c6ff48abb0c38933bd486

Comment 3

[Mayank Bansal]

Bug 1966135 seems the most likely.

Comment 4

[Edgar Chen [:edgar]]

I also hit this assertion while writing a test for bug 1994763. I’ll see if I can figure out what’s going on.

Comment 5

[Edgar Chen [:edgar]]

Attachment: Bug 1978714 - Ignore UAWidget when nsContentUtils::GetIndexInParent() is called with TreeKind::Flat;

nsContentUtils::GetIndexInParent() with Flat TreeKind can be called from layout
or selection code. In the selection case, the UAWidget is ingored while compute the
parent node, and the shadow host is used instead. This patch attempts to detect
that situation and use the appropriate way to compute the index.

Bug 2012637 is going to introduce a TreeKind for selection, at which point this
hacky detection will no longer be needed.

Comment 6

[Edgar Chen [:edgar]]

https://treeherder.mozilla.org/jobs?repo=try&group_state=expanded&revision=4e28c08ea06b1129859e476e59d58de91cc27df5

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/23721b7e0202
https://hg.mozilla.org/integration/autoland/rev/52cf55b72244
Ignore UAWidget when nsContentUtils::GetIndexInParent() is called with TreeKind::Flat; r=masayuki

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/070651af740a
https://hg.mozilla.org/integration/autoland/rev/c6bd459a0d55
Revert "Bug 1978714 - Ignore UAWidget when nsContentUtils::GetIndexInParent() is called with TreeKind::Flat; r=masayuki" for causing mochitest failures @ test_htmlcopyencoder_details

Comment 9

[Sandor Molnar[:smolnar]]

Backed out for causing mochitest failures @ test_htmlcopyencoder_details

Backout link: https://hg.mozilla.org/integration/autoland/rev/c6bd459a0d55ef1962cfca89d6f5a7db33100a6f

Push with failures

Failure log -> TEST-UNEXPECTED-FAIL | dom/serializers/tests/mochitest/test_htmlcopyencoder_details.html

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/511b8c51b05b
https://hg.mozilla.org/integration/autoland/rev/ce49d9be5dd1
Ignore UAWidget when nsContentUtils::GetIndexInParent() is called with TreeKind::Flat; r=masayuki

Comment 11

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/ce49d9be5dd1

Comment 12

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260130092147-20b1a1e6c530.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.