2052026 - Crash in [@ nsINode::IsMaybeSelected]

Status: RESOLVED FIXED

(Core :: DOM: Selection, defect)

Description

[Dianna Smith [:diannaS]]

Crash report: https://crash-stats.mozilla.org/report/index/a59897f3-7d35-4f0d-a41e-654570260701

Reason:

SIGSEGV / SEGV_MAPERR

Top 10 frames:

0  libxul.so  nsINode::IsMaybeSelected() const  dom/base/nsINode.h:2077
0  libxul.so  mozilla::dom::AbstractRange::MarkDescendants(nsINode&)  dom/base/AbstractRange.cpp:143
0  libxul.so  mozilla::dom::AbstractRange::RegisterClosestCommonInclusiveAncestor(nsINode*)  dom/base/AbstractRange.cpp:506
0  libxul.so  mozilla::dom::AbstractRange::RegisterSelection(mozilla::dom::Selection&)  dom/base/AbstractRange.cpp:474
1  libxul.so  mozilla::dom::Selection::StyledRanges::MaybeAddRangeAndTruncateOverlaps(nsRan...  dom/base/Selection.cpp:1454
2  libxul.so  mozilla::dom::Selection::AddRangesForUserSelectableNodes(nsRange*, mozilla::M...  dom/base/Selection.cpp:1352
3  libxul.so  mozilla::dom::Selection::AddRangesForSelectableNodes(nsRange*, mozilla::Maybe...  dom/base/Selection.cpp:1386
4  libxul.so  mozilla::dom::Selection::SetAnchorFocusToRange(nsRange*)  dom/base/Selection.cpp:3123
5  libxul.so  mozilla::dom::Selection::ExtendInternal(nsINode&, unsigned int, mozilla::Erro...  dom/base/Selection.cpp:0
6  libxul.so  mozilla::dom::Selection::Extend(nsINode*, unsigned int)  dom/base/Selection.cpp:3200

Comment 1

[Jan Jaeschke [:jjaschke]]

Crash looks like commonAncestor might be null?

Comment 2

[Jan Jaeschke [:jjaschke]]

Marking S3 because of regressor stack having been backed out. (Otherwise likely S2)

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Okay, I reproduced the crash with a URL reported by a crash report.

Comment 4

[Dianna Smith [:diannaS]]

fixed by backout of the regressor

Comment 5

[Dianna Smith [:diannaS]]

:masayuki or would you rather have this leave-open so you can address it separately? feel free to re-open if so

Comment 6

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: testcase

Press in the text and drag into the gray box.

Comment 7

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

I need to append a patch within this bug.

Comment 8

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Well, the reason is, we have excluded the shadow of SVG <use> in the DOM APIs.
https://searchfox.org/firefox-main/rev/bac4e9ee6b48aeeba4978df2eefa07bc2081fdc8/dom/base/nsINode.cpp#4460-4462

However, we allow users to extend selection across the shadow DOM boundary. Therefore, the range across the boundary is treated as disconnected. So, we should treat the shadow of <use> as flattened in the flat tree for selection.

Comment 9

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

The patch is already completed.
https://treeherder.mozilla.org/jobs?repo=try&revision=7907628f3aa7aa0e74a31897f84914a97550b0c5

However, I'm adding some crash annotations for the similar failures.

Comment 10

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Bug 2052026 - Treat the UA shadow for SVG `<use>` as a part of the flat tree for selection r=smaug!

Currently, we allow extending selection range into a shadow of <use>
even though it's our own closed shadow. Therefore, we need to be
consistent about this in the each DOM API. I.e., we should treat the
shadow for SVG <use> as a part of the flat tree for selection.

Additionally, this corrects the DOM path of the the containers if
they should have connected but disconnected. To avoid to leak the
privacy, this adds an option to the node's debug printer to exclude
class and id attribute values and the data of CharacterData.

Comment 11

[BugBot [:suhaib / :marco]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 10 desktop browser crashes on nightly

:masayuki, could you consider increasing the severity of this top-crash bug?

For more information, please visit BugBot documentation.

Comment 12

[Andrew McCreight [:mccr8]]

Looks like this is an alternate signature for the same crash: [@ mozilla::dom::AbstractRange::MarkDescendants ]

Comment 13

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

The patches have already been backed out.

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/deec723b5a20
https://hg.mozilla.org/integration/autoland/rev/c71e2e219208
Treat the UA shadow for SVG `<use>` as a part of the flat tree for selection r=smaug,webidl

Comment 15

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/c71e2e219208