2053867 - Hit MOZ_CRASH(Invalid ContentCache data) at checkouts/gecko/widget/ContentCache.cpp:107

Status: VERIFIED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20260707-969c51e9686e (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Hit MOZ_CRASH(Invalid ContentCache data) at checkouts/gecko/widget/ContentCache.cpp:107

#0 0x79a2c96ca9f6 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x79a2c96ca9f6 in mozilla::ContentCache::AssertIfInvalid() const /builds/worker/workspace/obj-build/widget/./../../../checkouts/gecko/widget/ContentCache.cpp:107:3
#2 0x79a2c96cc391 in mozilla::ContentCacheInChild::CacheCaret(nsIWidget*, mozilla::widget::IMENotification const*) /builds/worker/workspace/obj-build/widget/./../../../checkouts/gecko/widget/ContentCache.cpp:266:3
#3 0x79a2c96ceabd in mozilla::ContentCacheInChild::SetSelection(nsIWidget*, mozilla::widget::IMENotification::SelectionChangeDataBase const&) /builds/worker/workspace/obj-build/widget/./../../../checkouts/gecko/widget/ContentCache.cpp:676:3
#4 0x79a2c96f3592 in mozilla::widget::PuppetWidget::NotifyIMEOfSelectionChange(mozilla::widget::IMENotification const&) /builds/worker/workspace/obj-build/widget/./../../../checkouts/gecko/widget/PuppetWidget.cpp:781:7
#5 0x79a2c96fd6eb in mozilla::widget::TextEventDispatcher::NotifyIME(mozilla::widget::IMENotification const&) /builds/worker/workspace/obj-build/widget/./../../../checkouts/gecko/widget/TextEventDispatcher.cpp:471:40
#6 0x79a2c96bfe02 in nsIWidget::NotifyIME(mozilla::widget::IMENotification const&) /builds/worker/checkouts/gecko/widget/nsIWidget.cpp:1971:43
#7 0x79a2c76d563d in mozilla::IMEStateManager::NotifyIME(mozilla::widget::IMENotification const&, nsIWidget*, mozilla::dom::BrowserParent*) /builds/worker/workspace/obj-build/dom/events/./../../../../checkouts/gecko/dom/events/IMEStateManager.cpp:0:0
#8 0x79a2c76df53f in mozilla::IMEContentObserver::IMENotificationSender::SendSelectionChange() /builds/worker/workspace/obj-build/dom/events/./../../../../checkouts/gecko/dom/events/IMEContentObserver.cpp:2193:3
#9 0x79a2c76de405 in mozilla::IMEContentObserver::IMENotificationSender::Run() /builds/worker/workspace/obj-build/dom/events/./../../../../checkouts/gecko/dom/events/IMEContentObserver.cpp:2003:7
#10 0x79a2c9b5121b in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2406:13
#11 0x79a2c9b5c9e1 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:365:13
#12 0x79a2c9b5c9e1 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:343:7
#13 0x79a2c9b5c8e0 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:359:5
#14 0x79a2c9b5c78d in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:946:5
#15 0x79a2c9b5bdca in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:856:5
#16 0x79a2c9b5b136 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:587:14
#17 0x79a2c8e3efbb in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:64:15
#18 0x79a2c90cda20 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/dom/ipc/./../../ipc/ipdl/PVsyncChild.cpp:241:78
#19 0x79a2c437900c in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/glue/./../ipdl/PBackgroundChild.cpp:4955:32
#20 0x79a2c43173be in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1797:25
#21 0x79a2c4314934 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::unique_ptr<IPC::Message, std::default_delete<IPC::Message>>) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1723:9
#22 0x79a2c4315347 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1512:3
#23 0x79a2c4316329 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1614:14
#24 0x79a2c41e4c67 in mozilla::RunnableTask::Run() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:719:16
#25 0x79a2c41da0e4 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1358:20
#26 0x79a2c41d8c17 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1181:15
#27 0x79a2c41d9095 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:655:36
#28 0x79a2c41e4386 in operator() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:347:37
#29 0x79a2c41e4386 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:536:5
#30 0x79a2c41f8f23 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThread.cpp:1179:16
#31 0x79a2c41fec7f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:472:10
#32 0x79a2c431d2b7 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessagePump.cpp:83:21
#33 0x79a2c4274c31 in RunHandler /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:364:3
#34 0x79a2c4274c31 in MessageLoop::Run() /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:346:3
#35 0x79a2c9713b58 in nsBaseAppShell::Run() /builds/worker/workspace/obj-build/widget/./../../../checkouts/gecko/widget/nsBaseAppShell.cpp:151:27
#36 0x79a2c97ee874 in nsAppShell::Run() /builds/worker/workspace/obj-build/widget/gtk/./../../../../checkouts/gecko/widget/gtk/nsAppShell.cpp:575:33
#37 0x79a2ca87095b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:656:20
#38 0x79a2c431e164 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessagePump.cpp:233:9
#39 0x79a2c4274c31 in RunHandler /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:364:3
#40 0x79a2c4274c31 in MessageLoop::Run() /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:346:3
#41 0x79a2ca8700b2 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:594:34
#42 0x591e291f2bfc in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:466:22

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260709205531-5b3db67631ae.
The bug appears to have been introduced in the following build range:

Start: 0171c19d869add8c086617fb4f93ed79a23b968b (20260521123735)
End: 392a642aac421de0c7cea0587eaa5b7e6c8487e9 (20260521131905)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=0171c19d869add8c086617fb4f93ed79a23b968b&tochange=392a642aac421de0c7cea0587eaa5b7e6c8487e9

Comment 2

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 2031575

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Bug 2053867 - Do not reuse `IMEContentObserver` instance if observing editing host is changed r=jjaschke!

Currently, we allow users to edit content in a nested editing host in
a focused editing host. In this case,
mRootEditableNodeOrTextControlElement is the focused editing host and
mRootElement is the nested editing host and IMEContentObserver sent
IME_NOTIFY_IME_OF_FOCUS as in mRootElement.

When the nested editing host is moved outside the focused editing host,
the DOM focus is not changed. Therefore, IMEContentObserver needs to
observe the focused editing host. So, from IME point of view, IME focus
is now changed. I.e., IMEContentObserver should be recreated to notify
IME of a blur and focus.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/deee912d7631
https://hg.mozilla.org/integration/autoland/rev/b6790f2be5aa
Do not reuse `IMEContentObserver` instance if observing editing host is changed r=jjaschke

Comment 5

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/61366 for changes under testing/web-platform/tests

Comment 6

[amarc]

https://hg.mozilla.org/mozilla-central/rev/b6790f2be5aa

Comment 7

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:masayuki, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox153 to wontfix.

For more information, please visit BugBot documentation.

Comment 8

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 9

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260717092713-300705c65d1b.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 10

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Bug 2053867 - Do not reuse `IMEContentObserver` instance if observing editing host is changed

Currently, we allow users to edit content in a nested editing host in
a focused editing host. In this case,
mRootEditableNodeOrTextControlElement is the focused editing host and
mRootElement is the nested editing host and IMEContentObserver sent
IME_NOTIFY_IME_OF_FOCUS as in mRootElement.

When the nested editing host is moved outside the focused editing host,
the DOM focus is not changed. Therefore, IMEContentObserver needs to
observe the focused editing host. So, from IME point of view, IME focus
is now changed. I.e., IMEContentObserver should be recreated to notify
IME of a blur and focus.

Original Revision: https://phabricator.services.mozilla.com/D311764

Comment 11

[Phabricator Automation]

firefox-release Uplift Approval Request

• User impact if declined/Reason for urgency: The crash is a new regression of bug 2031575.
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: This makes IMEContentObserver won't be reused if it observed a nested editing host and it's moved outside the focused editing host. So, anyway, IMEContentObserver will be recreated even if this fails to consider something.
• String changes made/needed?: no
• Is Android affected?: yes

Comment 12

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 2031575

Comment 13

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/6ce6fc3404ba
https://hg.mozilla.org/releases/mozilla-release/rev/71e465c11592

Comment 14

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr153/rev/2d310af4ad32