1979204 - Assertion failure: offset == 0 || offset == 1, at /builds/worker/checkouts/gecko/accessible/basetypes/HyperTextAccessibleBase.cpp:335

Status: VERIFIED FIXED

(Core :: Disability Access APIs, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing 20250721-9396a65ed903 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: offset == 0 || offset == 1, at /builds/worker/checkouts/gecko/accessible/basetypes/HyperTextAccessibleBase.cpp:335

#0 0x7fffed275f2e in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:248:3
#1 0x7fffed275f2e in mozilla::a11y::HyperTextAccessibleBase::ToTextLeafPoint(int, bool) /builds/worker/checkouts/gecko/accessible/basetypes/HyperTextAccessibleBase.cpp:335:5
#2 0x7fffed24ef82 in mozilla::a11y::TextLeafPoint::GetCaret(mozilla::a11y::Accessible*) /builds/worker/checkouts/gecko/accessible/base/TextLeafRange.cpp:1097:31
#3 0x7fffed24eb45 in mozilla::a11y::SelectionManager::ProcessTextSelChangeEvent(mozilla::a11y::AccEvent*) /builds/worker/checkouts/gecko/accessible/base/SelectionManager.cpp:131:27
#4 0x7fffed23c064 in mozilla::a11y::EventQueue::ProcessEventQueue() /builds/worker/checkouts/gecko/accessible/base/EventQueue.cpp:445:23
#5 0x7fffed24d07b in mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) /builds/worker/checkouts/gecko/accessible/base/NotificationController.cpp:1052:3
#6 0x7fffecc28745 in nsRefreshDriver::TickObserverArray(unsigned int, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2257:10
#7 0x7fffecc26c59 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2547:8
#8 0x7fffecc304d1 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:370:13
#9 0x7fffecc304d1 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:348:7
#10 0x7fffecc303d0 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:364:5
#11 0x7fffecc3027d in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:954:5
#12 0x7fffecc2f81a in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:864:5
#13 0x7fffecc2ed16 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:595:14
#14 0x7fffec032c3b in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:66:15
#15 0x7fffec2b197d in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:229:78
#16 0x7fffe7aeedd2 in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:5061:32
#17 0x7fffe7a9047e in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1795:25
#18 0x7fffe7a8da00 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::unique_ptr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1721:9
#19 0x7fffe7a8e407 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1512:3
#20 0x7fffe7a8f3e9 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1612:14
#21 0x7fffe6ec1857 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:703:16
#22 0x7fffe6eba95e in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1310:20
#23 0x7fffe6eb9697 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1133:15
#24 0x7fffe6eb9b15 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:639:36
#25 0x7fffe6ec88f9 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:336:37
#26 0x7fffe6ec88f9 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#27 0x7fffe6eda493 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1159:16
#28 0x7fffe6ee0bbf in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#29 0x7fffec00c20c in bool mozilla::SpinEventLoopUntil<(mozilla::ProcessFailureBehavior)1, mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::NotNull<mozilla::dom::BrowserChild*>, nsIOpenWindowInfo*, unsigned int, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, mozilla::dom::UserActivation::Modifiers const&, bool, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**)::$_6>(nsTSubstring<char> const&, mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::NotNull<mozilla::dom::BrowserChild*>, nsIOpenWindowInfo*, unsigned int, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, mozilla::dom::UserActivation::Modifiers const&, bool, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**)::$_6&&, nsIThread*) /builds/worker/workspace/obj-build/dist/include/mozilla/SpinEventLoopUntil.h:176:25
#30 0x7fffec00a574 in mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::NotNull<mozilla::dom::BrowserChild*>, nsIOpenWindowInfo*, unsigned int, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, mozilla::dom::UserActivation::Modifiers const&, bool, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/ipc/ContentChild.cpp:1286:5
#31 0x7fffec040e40 in mozilla::dom::BrowserChild::ProvideWindow(nsIOpenWindowInfo*, unsigned int, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, mozilla::dom::UserActivation::Modifiers const&, bool, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:674:14
#32 0x7fffed7d28cf in nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, nsIURI*, nsTSubstring<char> const&, nsTSubstring<char> const&, mozilla::dom::UserActivation::Modifiers const&, bool, bool, bool, nsIArray*, bool, bool, bool, nsPIWindowWatcher::PrintKind, nsDocShellLoadState*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/toolkit/components/windowwatcher/nsWindowWatcher.cpp:990:24
#33 0x7fffed7d1694 in nsWindowWatcher::OpenWindow2(mozIDOMWindowProxy*, nsIURI*, nsTSubstring<char> const&, nsTSubstring<char> const&, mozilla::dom::UserActivation::Modifiers const&, bool, bool, bool, nsIArray*, bool, bool, bool, nsPIWindowWatcher::PrintKind, nsDocShellLoadState*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/toolkit/components/windowwatcher/nsWindowWatcher.cpp:388:10
#34 0x7fffe8bfebee in nsGlobalWindowOuter::OpenInternal(nsTSubstring<char> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, bool, bool, bool, bool, nsIArray*, nsDocShellLoadState*, bool, nsGlobalWindowOuter::PrintKind, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:6835:21
#35 0x7fffe8c0299d in OpenJS /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:5515:10
#36 0x7fffe8c0299d in nsGlobalWindowOuter::OpenOuter(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:5480:17
#37 0x7fffe8bb81c9 in nsGlobalWindowInner::Open(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:3998:3
#38 0x7fffe9c21999 in mozilla::dom::Window_Binding::open(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./WindowBinding.cpp:2796:59
#39 0x7fffea186895 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3306:13
#40 0x7fffed9e9784 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:501:13
#41 0x7fffed9e8fdf in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:597:12
#42 0x7fffee54b4d2 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jit/BaselineIC.cpp:1705:10
#43 0x35ffec5520fe  ([anon:js-executable-memory]+0x1c0fe)

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20250724212906-2c28b9cc7958.
The bug appears to have been introduced in the following build range:

Start: 5b983332405acf13b53f492bc6aea54a0f63d7c5 (20250711063430)
End: 9dea322815b85ddfc5225d77da3ffe0054b43b8f (20250711064615)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=5b983332405acf13b53f492bc6aea54a0f63d7c5&tochange=9dea322815b85ddfc5225d77da3ffe0054b43b8f

Comment 2

[BugBot [:suhaib / :marco]]

:Jamie, since you are the author of the regressor, bug 1950748, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 3

[James Teh [:Jamie]]

This problem has existed for quite some time now, but the assertion I added exposes it.

RemoveChild and InsertChildAt have overrides in hyperTextAccessible which invalidate the HyperText offsets cache. However, RelocateChild doesn't have a similar override. That means the HyperText offsets cache can be out of date, which breaks fundamental expectations.

Comment 4

[James Teh [:Jamie]]

Attachment: Bug 1979204: Invalidate cached HyperText offsets when relocating a child within its parent.

Previously, we did this for insertion and removal, but not relocation.
This meant that if something queried HyperText offsets soon after a child was relocated, the HyperText offset cache could be stale.
This could result in very broken expectations such as an embedded object having more than 1 offset.
This was causing an assertion, but could likely result in other obscure problems too.

Comment 5

[James Teh [:Jamie]]

https://treeherder.mozilla.org/jobs?repo=try&landoCommitID=145088

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/6fe00ec5610c
https://hg.mozilla.org/integration/autoland/rev/432d52bd3ee3
Invalidate cached HyperText offsets when relocating a child within its parent. r=eeejay

Comment 7

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/432d52bd3ee3

Comment 8

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20250731153714-d34398f38898.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

What's the real-world impact of this bug? Is it worth uplifting?

Comment 10

[James Teh [:Jamie]]

I honestly don't know. It's existed for quite some time now and users don't seem to have noticed; this assertion I added just exposed it. I also think it'd be quite rare. I think this can ride the trains.