Closed Bug 2014615 Opened 1 month ago Closed 1 month ago

Assertion failure: mPreCharacterDataChangeLength < 0 (CharacterDataChanged() should've reset mPreCharacterDataChangeLength), at /builds/worker/checkouts/gecko/dom/events/IMEContentObserver.cpp:920

Categories

(Core :: DOM: UI Events & Focus Handling, defect)

Product:
Core
Component:
DOM: UI Events & Focus Handling
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
149 Branch
Tracking Flags:
Tracking Status
firefox-esr140 --- unaffected
firefox147 --- unaffected
firefox148 --- unaffected
firefox149 --- verified

People

(Reporter: tsmith, Assigned: emilio)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])

Attachments

(2 files)

testcase.html
214 bytes, text/html
Details
Bug 2014615 - Move IMEContentObserver check for anon nodes earlier. r=masayuki
48 bytes, text/x-phabricator-request
Details | Review
Attached file testcase.html —

Found while fuzzing m-c 20260203-62b991cbf350 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: mPreCharacterDataChangeLength < 0 (CharacterDataChanged() should've reset mPreCharacterDataChangeLength), at /builds/worker/checkouts/gecko/dom/events/IMEContentObserver.cpp:920

#0 0x7cab42384a5a in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
#1 0x7cab42384a5a in mozilla::IMEContentObserver::CharacterDataWillChange(nsIContent*, CharacterDataChangeInfo const&) /builds/worker/checkouts/gecko/dom/events/IMEContentObserver.cpp:918:3
#2 0x7cab40698e41 in operator() /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:121:20
#3 0x7cab40698e41 in ForEachAncestorObserver<(lambda at /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:121:20)> /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:60:11
#4 0x7cab40698e41 in Notify<(NotifyPresShell)2, (lambda at /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:121:20)> /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:94:19
#5 0x7cab40698e41 in mozilla::dom::MutationObservers::NotifyCharacterDataWillChange(nsIContent*, CharacterDataChangeInfo const&) /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:121:3
#6 0x7cab4043a1cc in mozilla::dom::CharacterData::SetTextInternal(unsigned int, unsigned int, char16_t const*, unsigned int, bool, MutationEffectOnScript, CharacterDataChangeInfo::Details*) /builds/worker/checkouts/gecko/dom/base/CharacterData.cpp:247:5
#7 0x7cab4043d9d3 in mozilla::dom::CharacterData::SetText(char16_t const*, unsigned int, bool) /builds/worker/checkouts/gecko/dom/base/CharacterData.cpp:498:10
#8 0x7cab42604e23 in SetText /builds/worker/workspace/obj-build/dist/include/mozilla/dom/CharacterData.h:137:12
#9 0x7cab42604e23 in mozilla::dom::HTMLSelectElement::SelectedContentTextMightHaveChanged() /builds/worker/checkouts/gecko/dom/html/HTMLSelectElement.cpp:1696:13
#10 0x7cab40699221 in operator() /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:128:20
#11 0x7cab40699221 in ForEachAncestorObserver<(lambda at /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:128:20)> /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:60:11
#12 0x7cab40699221 in Notify<(NotifyPresShell)2, (lambda at /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:128:20)> /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:94:19
#13 0x7cab40699221 in mozilla::dom::MutationObservers::NotifyCharacterDataChanged(nsIContent*, CharacterDataChangeInfo const&) /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:128:3
#14 0x7cab4043a70f in mozilla::dom::CharacterData::SetTextInternal(unsigned int, unsigned int, char16_t const*, unsigned int, bool, MutationEffectOnScript, CharacterDataChangeInfo::Details*) /builds/worker/checkouts/gecko/dom/base/CharacterData.cpp:322:5
#15 0x7cab4043ad60 in InsertDataInternal /builds/worker/checkouts/gecko/dom/base/CharacterData.cpp:189:17
#16 0x7cab4043ad60 in mozilla::dom::CharacterData::AppendDataInternal(nsTSubstring<char16_t> const&, MutationEffectOnScript, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/CharacterData.cpp:183:3
#17 0x7cab426447dd in MergeWithNextTextNode(mozilla::dom::Text&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/html/nsGenericHTMLElement.cpp:3329:9
#18 0x7cab426445aa in nsGenericHTMLElement::SetOuterText(nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/html/nsGenericHTMLElement.cpp:3360:7
#19 0x7cab409e3462 in mozilla::dom::HTMLElement_Binding::set_outerText(JSContext*, JS::Handle<JSObject*>, void*, JSJitSetterCallArgs) /builds/worker/workspace/obj-build/dom/bindings/./HTMLElementBinding.cpp:1418:24
#20 0x7cab41a5344d in bool mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::NormalThisPolicy>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3253:10
#21 0x7cab46621e44 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:490:13
#22 0x7cab466216ef in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:586:12
#23 0x7cab46622aec in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:685:8
#24 0x7cab46623d84 in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:816:10
#25 0x7cab469b1900 in SetExistingProperty(JSContext*, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<js::NativeObject*>, js::PropertyResult const&, JS::ObjectOpResult&) /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2715:8
#26 0x7cab469b0852 in bool js::NativeSetProperty<(js::QualifiedBool)1>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2750:14
#27 0x7cab46630165 in SetObjectElementOperation /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:1575:10
#28 0x7cab46630165 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3018:12
#29 0x7cab46620d6a in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:460:13
#30 0x7cab46621715 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:618:13
#31 0x7cab46622aec in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:685:8
#32 0x7cab468658bb in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:119:10
#33 0x7cab418fd885 in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventHandlerBinding.cpp:65:37
#34 0x7cab4239aceb in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget>>(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObjectBase::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:82:12
#35 0x7cab42399832 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /builds/worker/checkouts/gecko/dom/events/JSEventHandler.cpp:201:12
#36 0x7cab42374f41 in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1282:22
#37 0x7cab42376099 in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1588:12
#38 0x7cab42375981 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1493:35
#39 0x7cab4236a32e in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:465:5
#40 0x7cab4236a32e in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:364:17
#41 0x7cab423699fc in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:605:16
#42 0x7cab4236c1b2 in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1260:11
#43 0x7cab4470c9ea in nsDocumentViewer::LoadComplete(nsresult) /builds/worker/checkouts/gecko/layout/base/nsDocumentViewer.cpp:968:7
#44 0x7cab44b822b0 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:6523:13
#45 0x7cab44b817af in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:5844:7
#46 0x7cab44b82e12 in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:0:0
#47 0x7cab3f42e929 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:1527:3
#48 0x7cab3f42e0e2 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:1059:14
#49 0x7cab3f42bc64 in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:854:9
#50 0x7cab3f42d48a in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:722:5
#51 0x7cab44ba99cf in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:14923:23
#52 0x7cab3e7a4d3f in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:656:22
#53 0x7cab3e7a5ee6 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:540:10
#54 0x7cab40592cac in mozilla::dom::Document::DoUnblockOnload() /builds/worker/checkouts/gecko/dom/base/Document.cpp:12492:18
#55 0x7cab405789e6 in mozilla::dom::Document::DispatchContentLoadedEvents() /builds/worker/checkouts/gecko/dom/base/Document.cpp:8715:3
#56 0x7cab40644ab5 in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:18
#57 0x7cab40644ab5 in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:60:14
#58 0x7cab40644ab5 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:95:14
#59 0x7cab40644ab5 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/tuple:1740:14
#60 0x7cab40644ab5 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/tuple:1751:14
#61 0x7cab40644ab5 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1081:12
#62 0x7cab40644ab5 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1132:13
#63 0x7cab3e541ad7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:705:16
#64 0x7cab3e53c1a4 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1325:20
#65 0x7cab3e53ae27 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1148:15
#66 0x7cab3e53b2a5 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:641:36
#67 0x7cab3e54adb6 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:333:37
#68 0x7cab3e54adb6 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:549:5
#69 0x7cab3e55d333 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1168:16
#70 0x7cab3e562f8f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:461:10
#71 0x7cab3f1528e7 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#72 0x7cab3f0abcf1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:366:3
#73 0x7cab3f0abcf1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:348:3
#74 0x7cab44261f68 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:152:27
#75 0x7cab4432da44 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:555:33
#76 0x7cab4537576b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:652:20
#77 0x7cab3f153794 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#78 0x7cab3f0abcf1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:366:3
#79 0x7cab3f0abcf1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:348:3
#80 0x7cab45374ecf in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:590:34
#81 0x59d142ccbf8c in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:465:22
Flags: in-testsuite?

Verified bug as reproducible on mozilla-central 20260205042023-4779d1a57487.
The bug appears to have been introduced in the following build range:

Start: dc8b5887c8720bba979d6e8b19349ed95daca2c8 (20260203125751)
End: 6204449ef95542f67bdc2ad633c9ca14b9d150b4 (20260203143642)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=dc8b5887c8720bba979d6e8b19349ed95daca2c8&tochange=6204449ef95542f67bdc2ad633c9ca14b9d150b4

Keywords: regression
Whiteboard: [bugmon:bisected,confirmed]

Looks like regressed by bug 2011709. Although I don't understand what happened yet.

Regressed by: 2011709

Set release status flags based on info from the regressing bug 2011709

:emilio, since you are the author of the regressor, bug 2011709, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

status-firefox147: --- → unaffected
status-firefox148: --- → unaffected
status-firefox-esr140: --- → unaffected
Flags: needinfo?(emilio)

So it seems IMEContentObserver expects CharacterDataWillChange to be followed by CharacterDataChanged, without any other notification in between. My patch updates the selected content synchronously, causing IMEContentObserver to see:

  • CharacterDataWillChange for the option
  • CharacterDataWillChange for the selected text (here it asserts)
  • CharacterDataChanged for the selected text
  • CharacterDataChanged for the option

Masayuki, is it easy to stop making that assumption in IMEContentObserver? If not I guess I could delay a bit the text update by using a script runner or something.

Flags: needinfo?(emilio) → needinfo?(masayuki)

Ah, yeah, I midaired with comment 4, but yeah moving the assert under that early-out would work.

Flags: needinfo?(masayuki)

This avoids tripping on the shadow tree mutation. Move the
NodeNeedsTextChange check earlier since it is cheaper.

Assignee: nobody → emilio
Status: NEW → ASSIGNED
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/57599 for changes under testing/web-platform/tests
Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed], [wptsync upstream]

https://hg.mozilla.org/mozilla-central/rev/c004612fd94d

Status: ASSIGNED → RESOLVED
Closed: 1 month ago
status-firefox149: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 149 Branch
Upstream PR merged by moz-wptsync-bot

Verified bug as fixed on rev mozilla-central 20260206213744-17c590744962.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
status-firefox149: fixed → verified
Keywords: bugmon
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: