1979588 - Crash in [@ mozilla::dom::RangeBasedTextDirectiveCreator::CollectContextTermWordBoundaryDistances]

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/2091f660-9014-4b06-97c6-4b53d0250726

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(!mEndContent.IsEmpty())

Top 10 frames of crashing thread:

0  xul.dll  mozilla::dom::RangeBasedTextDirectiveCreator::CollectContextTermWordBoundaryDistances  dom/base/TextDirectiveCreator.cpp:388
1  xul.dll  mozilla::dom::TextDirectiveCreator::CreateTextDirectiveFromRange  dom/base/TextDirectiveCreator.cpp:55
2  xul.dll  mozilla::dom::FragmentDirective::CreateTextDirectiveForSelection  dom/base/FragmentDirective.cpp:468
3  xul.dll  mozilla::dom::FragmentDirective_Binding::createTextDirectiveForSelection  dom/bindings/FragmentDirectiveBinding.cpp:145
3  xul.dll  mozilla::dom::FragmentDirective_Binding::createTextDirectiveForSelection_promiseWrapper  dom/bindings/FragmentDirectiveBinding.cpp:156
4  xul.dll  mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises>  dom/bindings/BindingUtils.cpp:3309
5  xul.dll  CallJSNative  js/src/vm/Interpreter.cpp:501
5  xul.dll  js::InternalCallOrConstruct  js/src/vm/Interpreter.cpp:597
5  xul.dll  InternalCall  js/src/vm/Interpreter.cpp:664
5  xul.dll  js::CallFromStack  js/src/vm/Interpreter.cpp:669

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2025-07-26
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: No

By analyzing the backtrace, the regression may have been introduced by a patch [1] to fix Bug 1978976.

[1] https://hg.mozilla.org/mozilla-central/rev?node=5266c5cc9daa

:jjaschke, since you are the author of the potential regressor, could you please take a look?

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1978976

Comment 2

[Jan Jaeschke [:jjaschke]]

Quite low volume, this is also a diagnostic assert on a feature that's currently Nightly only. I'll be monitoring this in hope of some STRs.

Comment 3

[Frank Doty [:fdoty]]

I have a profile and crash report indicating this issue that I can reproduce easily locally - This occurs when I highlight a URL in an email (not a hyperlink, but the actual https full address) and right click. The tab crashes every time. As indicated in the bug, I am reproducing this in Nightly.

https://share.firefox.dev/3JJTRrj

the specific URL: https://account.clutch.com/subscriptions/e01e50d88893993cbe91431b8f0defb8e648119bc0153b0ffe36f78baf702f099d36abf45841ba52cd472fde77b18d9bfc3134e70681e09c39fb06c33de7f4802c7aafe9375b2da7e5535d8e0fb79228fa7532811ea8cf3354cd88335de7c798fbdef5048a635a469993bab5f507588b

https://crash-stats.mozilla.org/report/index/f1a2f4f9-9855-4d7d-96ea-8ac740250904

Comment 4

[Frank Doty [:fdoty]]

Restricting access as it's so easy to reproduce

Comment 5

[Jan Jaeschke [:jjaschke]]

Thanks a lot, with that I can debug this. I don’t think this needs to be a sec issue, this is just hitting an assertion. (I can’t make it public again though)

(Keeping the ni)

Comment 6

[Jan Jaeschke [:jjaschke]]

Attachment: Bug 1979588 - Text Fragments: Correctly deal with long words at end of range for range-based matching. r=#dom-core!

The range-based approach for creating a text directive uses the word breaker algorithm
to identify where to split between start and end term. If the range contains a word
which is over 50% of the length content, the algorithm would either return wordEnd=length or
wordStart=0, which would result in start or end term being empty, which is not allowed.

This patch catches these edge cases and ensures that start and end are always valid.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/7db1bf44de9e
https://hg.mozilla.org/integration/autoland/rev/729990f9affb
Text Fragments: Correctly deal with long words at end of range for range-based matching. r=dom-core,smaug

Comment 8

[amarc]

https://hg.mozilla.org/mozilla-central/rev/729990f9affb

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/4e8871487a9f
https://hg.mozilla.org/mozilla-central/rev/b1fda3f9af8a
Revert "Bug 1979588 - Text Fragments: Correctly deal with long words at end of range for range-based matching. r=dom-core,smaug" for causing crashes (bug 1987845) as part of the Nightly merge operations

Comment 10

[Cosmin Sabou [:CosminS]]

Backed out for causing crashes (Bug 1987845) as part of the Nightly merge operations:
backout link: https://hg.mozilla.org/mozilla-central/rev/b1fda3f9af8ae58da0ea4a24078dd75b784e79cf

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/2c73b063922b
https://hg.mozilla.org/integration/autoland/rev/a9560be525c8
Text Fragments: Correctly deal with long words at end of range for range-based matching. r=dom-core,smaug

Comment 12

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/a9560be525c8