2058744 - Assertion failure: (mIsSelected == nsTextFrame::SelectionState::Selected) == isReallySelected (Should have called InvalidateSelectionState()), at checkouts/gecko/layout/generic/nsTextFrame.cpp:8575

Status: VERIFIED FIXED

(Core :: DOM: Selection, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20260724-db59e73163ec (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: (mIsSelected == nsTextFrame::SelectionState::Selected) == isReallySelected (Should have called InvalidateSelectionState()), at checkouts/gecko/layout/generic/nsTextFrame.cpp:8575

#0 0x724d72edf1f6 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x724d72edf1f6 in nsTextFrame::IsFrameSelected() const /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsTextFrame.cpp:8573:5
#2 0x724d72ed1a1c in IsSelected /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.h:4078:64
#3 0x724d72ed1a1c in nsTextFrame::UnionAdditionalOverflow(nsPresContext*, nsIFrame*, nsTextFrame::PropertyProvider&, nsRect*, bool, bool) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsTextFrame.cpp:6249:8
#4 0x724d72eeb0b8 in nsTextFrame::RecomputeOverflow(nsIFrame*, bool) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsTextFrame.cpp:11645:3
#5 0x724d72ede2c3 in nsTextFrame::ComputeCustomOverflowInternal(mozilla::OverflowAreas&, bool) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsTextFrame.cpp:12136:20
#6 0x724d72e52e1c in nsIFrame::UpdateOverflow() /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:8795:8
#7 0x724d72b9f928 in mozilla::OverflowChangedTracker::Flush() /builds/worker/workspace/obj-build/dist/include/mozilla/OverflowChangedTracker.h:123:36
#8 0x724d72b9188c in FlushOverflowChangedTracker /builds/worker/workspace/obj-build/dist/include/mozilla/RestyleManager.h:236:64
#9 0x724d72b9188c in mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) /builds/worker/workspace/obj-build/layout/style/./../../../../checkouts/gecko/layout/style/RestyleManager.cpp:1988:3
#10 0x724d72b972ed in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /builds/worker/workspace/obj-build/layout/style/./../../../../checkouts/gecko/layout/style/RestyleManager.cpp:3315:7
#11 0x724d72b97b01 in mozilla::RestyleManager::ProcessPendingRestyles() /builds/worker/workspace/obj-build/layout/style/./../../../../checkouts/gecko/layout/style/RestyleManager.cpp:3414:3
#12 0x724d72c61701 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:4543:37
#13 0x724d6ea8a365 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1545:5
#14 0x724d6ea8a365 in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/workspace/obj-build/dom/base/./../../../../checkouts/gecko/dom/base/Document.cpp:11857:16
#15 0x724d6ea5d3a0 in FlushPendingNotifications /builds/worker/workspace/obj-build/dom/base/./../../../../checkouts/gecko/dom/base/Document.cpp:11789:3
#16 0x724d6ea5d3a0 in mozilla::dom::Document::AutoEditorCommandTarget::AutoEditorCommandTarget(mozilla::dom::Document&, mozilla::dom::Document::InternalCommandData const&) /builds/worker/workspace/obj-build/dom/base/./../../../../checkouts/gecko/dom/base/Document.cpp:5612:13
#17 0x724d6ea5e316 in mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, mozilla::dom::TrustedHTMLOrString const&, nsIPrincipal&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/base/./../../../../checkouts/gecko/dom/base/Document.cpp:5878:27
#18 0x724d6fd51917 in mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./DocumentBinding.cpp:4717:36
#19 0x724d6ff437f5 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./../../../../checkouts/gecko/dom/bindings/BindingUtils.cpp:3216:13

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260729041430-9654bd949e36.
The bug appears to have been introduced in the following build range:

Start: 1d8c624a9d81b5a24c56b5f86abe485288a43265 (20260705201657)
End: d85b17d4d4f8ad3af3a4e57537b525c5fb71b26e (20260706030134)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=1d8c624a9d81b5a24c56b5f86abe485288a43265&tochange=d85b17d4d4f8ad3af3a4e57537b525c5fb71b26e

Comment 2

[Edgar Chen [:edgar]]

Hi Masayuki, could this be caused by changes to Shadow DOM selection?

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 9/19-9/27)]

According to the regression range, yes. However, according to the testcase, no because there is no shadow DOM and editors do not support shadows in editable elements.

Perhaps, this detects a bug of the shadow DOM selection fixes or the new behavior exposed an extant bug within the testcase.

Comment 4

[BugBot [:suhaib / :marco]]

Based on comment #1, this bug contains a bisection range found by bugmon. However, the Regressed by field is still not filled.

:masayuki, if possible, could you fill the Regressed by field and investigate this regression?

For more information, please visit BugBot documentation.

Comment 5

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 9/19-9/27)]

Hmm, the text frame is for the empty Text in the <textarea> and mIsSelected is NotSelected but isReallySelected is true.

Comment 6

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 9/19-9/27)]

Ah, okay. I made selection handlers use TreeKind::FlatForSelection, but layout needs to use TreeKind::Flat. So, I need to revert some places.

Comment 7

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 9/19-9/27)]

Odd, reverting Selection.cpp and PresShell.cpp is not enough... I need to check the patches again to get where I touched.

Comment 8

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 9/19-9/27)]

Attachment: WIP: Bug 2058744 - part 1: Make `ContentSubtreeIterator` and `RangeSubtreeIterator` template classes r=smaug!

Comment 9

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 9/19-9/27)]

Attachment: WIP: Bug 2058744 - part 2: Make the layout related code use content iterators for `TreeKind::Flat` r=smaug!,emilio!

Comment 10

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 2012637

Comment 11

[Donal Meehan [:dmeehan]]

:masayuki, It's getting too late for Fx155 at this stage.
Fx156 goes to beta next week, should we keep this as affected, or will it be a wontfix at this point?

Comment 12

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 9/19-9/27)]

I still don't find some of the causes. Anyway, the patches will be big and risky. So, I cannot fix this immediately.

Comment 13

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 9/19-9/27)]

Ah, here uses the flattened tree instead of for selection. I found this when I investigating a bug of my patch.

Comment 14

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 9/19-9/27)]

(In reply to Masayuki Nakano [:masayuki] (he/him)(JST, +0900) from comment #13)

Ah, here uses the flattened tree instead of for selection. I found this when I investigating a bug of my patch.

Okay, this is the root cause.

Comment 15

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 9/19-9/27)]

Attachment: Bug 2058744 - Make `AbstractRange::UpdateDescendantsInFlattenedTree` use `TreeIterator<FlattenedChildIteratorForSelection>` r=emilio!

Currently, we treat selection across shadow DOM ignore UA widgets.
Therefore, the method should use FlattenedChildIteratorForSelection
instead of FlattenedChildIterator to set the selected flag of the
nodes in the range.

With this change, the default summary of <details> won't be rendered
as selected when the default <summary> is completely in a selection
range. This is different from Chrome, but we don't copy the default
summary to clipboard. Therefore, until we support to copy the default
summary, the new behavior matches with the result.

Comment 16

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/33599940e3f8
https://hg.mozilla.org/integration/autoland/rev/5b63c579d0b8
Make `AbstractRange::UpdateDescendantsInFlattenedTree` use `TreeIterator<FlattenedChildIteratorForSelection>` r=emilio

Comment 17

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/5b63c579d0b8

Comment 18

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:masayuki, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox156 to wontfix.

For more information, please visit BugBot documentation.

Comment 19

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 9/19-9/27)]

This changes the visual result of selection of <details>. Even though the selection matches with copy and Selection.toString(). However, we'd get unexpected regression report. So, I think this patch should ride the train.

Comment 20

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260903162905-9b69ffb62ec6.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 21

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/62440 for changes under testing/web-platform/tests

Comment 22

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot