2057692 - Assertion failure: pointInFlat->IsSetAndValid(), at checkouts/gecko/dom/base/nsRange.cpp:1263

Status: VERIFIED FIXED

(Core :: DOM: Selection, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20260709-5b3db67631ae (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: pointInFlat->IsSetAndValid(), at checkouts/gecko/dom/base/nsRange.cpp:1263

#0 0x7feef95d359a in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x7feef95d359a in nsRange::SetStartInternal(mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&, mozilla::dom::AllowRangeCrossShadowBoundary, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/base/./../../../../checkouts/gecko/dom/base/nsRange.cpp:1263:3
#2 0x7feef9806d4e in mozilla::dom::Selection::ExtendInternal(nsINode&, unsigned int, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/base/./../../../../checkouts/gecko/dom/base/Selection.cpp:3341:14
#3 0x7feef9807d36 in mozilla::dom::Selection::Extend(nsINode*, unsigned int) /builds/worker/workspace/obj-build/dom/base/./../../../../checkouts/gecko/dom/base/Selection.cpp:3190:3
#4 0x7feefd9f0a03 in nsFrameSelection::TakeFocus(nsIContent&, unsigned int, unsigned int, mozilla::CaretAssociationHint, nsFrameSelection::FocusMode) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsFrameSelection.cpp:1575:20
#5 0x7feefd9f1812 in nsFrameSelection::HandleClick(nsIContent*, unsigned int, unsigned int, nsFrameSelection::FocusMode, mozilla::CaretAssociationHint) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsFrameSelection.cpp:1321:12
#6 0x7feefd848387 in mozilla::PresShell::CompleteMove(bool, bool) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:2465:19
#7 0x7feef980d8a7 in mozilla::dom::Selection::Modify(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&) /builds/worker/workspace/obj-build/dom/base/./../../../../checkouts/gecko/dom/base/Selection.cpp:4316:16
#8 0x7feefa26ad14 in mozilla::dom::Selection_Binding::modify(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./SelectionBinding.cpp:1614:24
#9 0x7feefab3a515 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./../../../../checkouts/gecko/dom/bindings/BindingUtils.cpp:3216:13
#10 0x7feeff95cc04 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:498:13
#11 0x7feeff95c4bf in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:594:12
#12 0x7feefeee2016 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/obj-build/js/src/jit/./../../../../../checkouts/gecko/js/src/jit/BaselineIC.cpp:1717:10

Comment 1

[Tyson Smith [:tsmith]]

This was also detected by live site testing.

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260726215019-babfc4cf0664.
The bug appears to have been introduced in the following build range:

Start: 1d8c624a9d81b5a24c56b5f86abe485288a43265 (20260705201657)
End: 293c7c1a753c7165757c183bbd0448a27b12639c (20260706042047)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=1d8c624a9d81b5a24c56b5f86abe485288a43265&tochange=293c7c1a753c7165757c183bbd0448a27b12639c

Comment 3

[BugBot [:suhaib / :marco]]

:masayuki, since you are the author of the regressor, bug 2009328, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 4

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

This is just a bug of IsSetAndValid(). So, working with the point does not cause any problems, but some handling may fail with checking the result of the method.

Comment 5

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Bug 2057692 - Make `RangeBoundaryBase::IsSetAndValid()` use right API to get the max offset of the parent r=jjaschke!

If mTreeKind is for TreeKind::FlatForSelection, mParent->Length()
is wrong API if mParent is a shadow host or a <slot> which has
some assigned nodes.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/59f0d745d02c
https://hg.mozilla.org/integration/autoland/rev/a34b6a93d7a8
Make `RangeBoundaryBase::IsSetAndValid()` use right API to get the max offset of the parent r=jjaschke

Comment 7

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/61591 for changes under testing/web-platform/tests

Comment 8

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/a34b6a93d7a8

Comment 9

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:masayuki, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox154 to wontfix.

For more information, please visit BugBot documentation.

Comment 10

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Bug 2057692 - Make `RangeBoundaryBase::IsSetAndValid()` use right API to get the max offset of the parent

If mTreeKind is for TreeKind::FlatForSelection, mParent->Length()
is wrong API if mParent is a shadow host or a <slot> which has
some assigned nodes.

Original Revision: https://phabricator.services.mozilla.com/D314582

Comment 11

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: This is a bug of the validator method and that may return opposite result from the actual state. Therefore, users may see unexpected result in some cases.
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: This just makes the validation API to use the correct API to get the length (number of children) of the parent node in the flattened tree.
• String changes made/needed?: no
• Is Android affected?: yes

Comment 12

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260729041430-9654bd949e36.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 13

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 14

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/640567484703
https://hg.mozilla.org/releases/mozilla-beta/rev/1936a2d9c4d5