2039689 - Assertion failure: (mIsSelected == nsTextFrame::SelectionState::Selected) == isReallySelected (Should have called InvalidateSelectionState()), at checkouts/gecko/layout/generic/nsTextFrame.cpp:8519

Status: RESOLVED FIXED

(Core :: DOM: Selection, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20260514-3710783bfb55 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: (mIsSelected == nsTextFrame::SelectionState::Selected) == isReallySelected (Should have called InvalidateSelectionState()), at checkouts/gecko/layout/generic/nsTextFrame.cpp:8519

#0 0x7accbc479b56 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x7accbc479b56 in nsTextFrame::IsFrameSelected() const /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsTextFrame.cpp:8517:5
#2 0x7accbc61a332 in IsSelected /builds/worker/checkouts/gecko/layout/generic/nsIFrame.h:4011:64
#3 0x7accbc61a332 in mozilla::nsDisplayText::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /builds/worker/workspace/obj-build/layout/painting/./../../../../checkouts/gecko/layout/painting/nsDisplayList.cpp:7744:10
#4 0x7accb74129ac in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /builds/worker/workspace/obj-build/gfx/layers/./../../../../checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1856:41
#5 0x7accb7411229 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) /builds/worker/workspace/obj-build/gfx/layers/./../../../../checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:2181:7
#6 0x7accbc60d3d1 in CreateWebRenderCommandsNewClipListOption /builds/worker/workspace/obj-build/layout/painting/./../../../../checkouts/gecko/layout/painting/nsDisplayList.cpp:4762:30
#7 0x7accbc60d3d1 in CreateWebRenderCommands /builds/worker/workspace/obj-build/layout/painting/./../../../../checkouts/gecko/layout/painting/nsDisplayList.h:4999:12
#8 0x7accbc60d3d1 in mozilla::nsDisplayOwnLayer::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*, bool) /builds/worker/workspace/obj-build/layout/painting/./../../../../checkouts/gecko/layout/painting/nsDisplayList.cpp:5439:22
#9 0x7accbc60f213 in mozilla::nsDisplayOwnLayer::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /builds/worker/workspace/obj-build/layout/painting/./../../../../checkouts/gecko/layout/painting/nsDisplayList.h:5513:12
#10 0x7accb74129ac in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /builds/worker/workspace/obj-build/gfx/layers/./../../../../checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1856:41
#11 0x7accb7411229 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) /builds/worker/workspace/obj-build/gfx/layers/./../../../../checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:2181:7
#12 0x7accb740f9e2 in mozilla::layers::WebRenderCommandBuilder::BuildWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, mozilla::layers::WebRenderScrollData&, WrFiltersHolder&&) /builds/worker/workspace/obj-build/gfx/layers/./../../../../checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1782:5
#13 0x7accb74467db in mozilla::layers::WebRenderLayerManager::EndTransactionWithoutLayer(mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, WrFiltersHolder&&, mozilla::layers::WebRenderBackgroundData*, double, bool) /builds/worker/workspace/obj-build/gfx/layers/./../../../../checkouts/gecko/gfx/layers/wr/WebRenderLayerManager.cpp:373:30
#14 0x7accbc5fc6f5 in mozilla::nsDisplayList::PaintRoot(mozilla::nsDisplayListBuilder*, gfxContext*, unsigned int, mozilla::Maybe<double>) /builds/worker/workspace/obj-build/layout/painting/./../../../../checkouts/gecko/layout/painting/nsDisplayList.cpp:2353:18
#15 0x7accbc28f49a in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsLayoutUtils.cpp:3271:9
#16 0x7accbc20ffa2 in mozilla::PresShell::PaintInternal(nsIFrame*, mozilla::WindowRenderer*, mozilla::PaintInternalFlags) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:6642:5
#17 0x7accbc2272e9 in mozilla::PresShell::PaintSynchronously() /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:12487:3
#18 0x7accbc1c85a2 in nsRefreshDriver::PaintIfNeeded() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2641:9
#19 0x7accbc1c7ef7 in operator() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2556:60
#20 0x7accbc1c7ef7 in void nsRefreshDriver::RunRenderingPhaseLegacy<nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_14>(mozilla::RenderingPhase, nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_14&&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1280:3
#21 0x7accbc1c295f in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2554:3
#22 0x7accbc1cde6f in operator() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1800:25
#23 0x7accbc1cde6f in mozilla::detail::RunnableFunction<nsRefreshDriver::EnsureTimerStarted(nsRefreshDriver::EnsureTimerStartedFlags)::$_1>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:536:5
#24 0x7accb6961867 in mozilla::RunnableTask::Run() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:719:16
#25 0x7accb695fc52 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1358:20
#26 0x7accb695e8d7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1181:15
#27 0x7accb695ed55 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:655:36
#28 0x7accb696a109 in operator() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:350:37
#29 0x7accb696a109 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:536:5
#30 0x7accb697edb3 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThread.cpp:1179:16
#31 0x7accb69848af in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:472:10
#32 0x7accbbb052e7 in SpinEventLoopUntil<(mozilla::ProcessFailureBehavior)1, (lambda at ./../../../../checkouts/gecko/dom/xhr/XMLHttpRequestMainThread.cpp:3277:74)> /builds/worker/workspace/obj-build/dist/include/mozilla/SpinEventLoopUntil.h:174:25
#33 0x7accbbb052e7 in mozilla::dom::XMLHttpRequestMainThread::SendInternal(mozilla::dom::BodyExtractorBase const*, bool, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/xhr/./../../../../checkouts/gecko/dom/xhr/XMLHttpRequestMainThread.cpp:3277:10
#34 0x7accb90e3a77 in mozilla::dom::XMLHttpRequest_Binding::send(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./XMLHttpRequestBinding.cpp:1663:24
#35 0x7accb94cd0ef in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./../../../../checkouts/gecko/dom/bindings/BindingUtils.cpp:3217:13
#36 0x7accbe208c94 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:488:13
#37 0x7accbe20853f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:584:12
#38 0x7accbd7eda76 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/obj-build/js/src/jit/./../../../../../checkouts/gecko/js/src/jit/BaselineIC.cpp:1713:10
#39 0x1c04b87fcc7e  ([anon:js-executable-memory]+0xbc7e)

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260516000543-b7e2d7ef2e62.
The bug appears to have been introduced in the following build range:

Start: 354c926233a229a66903e38d8e592ca528fd9476 (20260125211630)
End: 83ccd8953f460350bf9407c07352bc1bedb0907e (20260125232203)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=354c926233a229a66903e38d8e592ca528fd9476&tochange=83ccd8953f460350bf9407c07352bc1bedb0907e

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 2

[Bugmon [:jkratzer for issues]]

A pernosco session for this bug can be found here.

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 9/19-9/27)]

The Text is the fallback content of the default <summary>.

The range becomes {<body>, 0} - {<body>, 2} with selectAllChildren(document.body) and getSelection().modify() does not change Selection...

Comment 4

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 9/19-9/27)]

Here uses a range boundary in anonymous node.
https://searchfox.org/firefox-main/rev/12dd4ecbfaedb20fe17e2087554a5de2b6e1cff0/dom/base/nsINode.cpp#553,642-643,651-652

So, we need to adjust here to boundaries for selection.

Comment 5

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 9/19-9/27)]

I verified that this will be fixed by bug 2014344. The blocker bug to land it, bug 2014622, is one of the my top priority job now. So, it should be fixed in a couple of weeks.

Comment 6

[Tyson Smith [:tsmith]]

This issue has also been detected via live site testing.

Comment 7

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20260514091837-3710783bfb55) but not with tip (mozilla-central 20260710095230-ddbfac25ce6f.)

The bug appears to have been fixed in the following build range:

Start: 1d8c624a9d81b5a24c56b5f86abe485288a43265 (20260705201657)
End: d85b17d4d4f8ad3af3a4e57537b525c5fb71b26e (20260706030134)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=1d8c624a9d81b5a24c56b5f86abe485288a43265&tochange=d85b17d4d4f8ad3af3a4e57537b525c5fb71b26e

masayuki, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 8

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 9/19-9/27)]

Yep, I'll add the test.

Comment 9

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 9/19-9/27)]

Attachment: Bug 2039689 - Add the reported testcase r=jjaschke!

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/6eb085bd2e42
https://hg.mozilla.org/integration/autoland/rev/e2bc92ca8535
Add the reported testcase r=jjaschke

Comment 11

[amarc]

https://hg.mozilla.org/mozilla-central/rev/e2bc92ca8535

Comment 12

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:masayuki, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox153 to wontfix.

For more information, please visit BugBot documentation.

Comment 13

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/61367 for changes under testing/web-platform/tests

Comment 14

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 15

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 9/19-9/27)]

This is fixed actually by the series of the shadow DOM selection. And this just adds the reported test. So, we don't need to uplift this.