Assertion failure: IsValidParent(mParent, mRef) (Initializing RangeBoundary with invalid value), at \builds\worker\workspace\obj-build\dist\include\mozilla\RangeBoundary.h:234
Categories
(Core :: DOM: Selection, defect)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox-esr115 | --- | unaffected |
| firefox-esr140 | --- | unaffected |
| firefox-esr153 | --- | unaffected |
| firefox154 | --- | wontfix |
| firefox155 | --- | wontfix |
| firefox156 | --- | fixed |
People
(Reporter: tsmith, Assigned: masayuki)
References
(Blocks 2 open bugs, Regression, )
Details
(4 keywords, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])
Attachments
(2 files)
Found while fuzzing m-c 20260706-ba2351b8401a (--enable-debug --enable-fuzzing)
To reproduce via Grizzly Replay:
$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>
Assertion failure: IsValidParent(mParent, mRef) (Initializing RangeBoundary with invalid value), at \builds\worker\workspace\obj-build\dist\include\mozilla\RangeBoundary.h:234
#0 0x788a15c783c7 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x788a15c783c7 in mozilla::RangeBoundaryBase<nsINode const*, nsIContent const*>::RangeBoundaryBase(nsINode const*, nsIContent const*, TreeKind) /builds/worker/workspace/obj-build/dist/include/mozilla/RangeBoundary.h:233:7
#2 0x788a1603ed55 in mozilla::RangeBoundaryBase<nsINode const*, nsIContent const*>::EndOfParent(nsINode const&, mozilla::RangeBoundarySetBy, TreeKind) /builds/worker/workspace/obj-build/dist/include/mozilla/RangeBoundary.h:209:14
#3 0x788a1603f9b3 in mozilla::RangeBoundaryBase<nsINode const*, nsIContent const*>::AsRangeBoundaryInFlatTreeOrNonFlattenedNode(mozilla::RangeBoundaryFor) const /builds/worker/workspace/obj-build/dist/include/mozilla/RangeBoundary.h:417:12
#4 0x788a16195357 in operator() /builds/worker/workspace/obj-build/dom/base/./../../../../checkouts/gecko/dom/base/nsINode.cpp:786:21
#5 0x788a16195357 in IsItemInRangeComparator::operator()(mozilla::dom::AbstractRange const*) const /builds/worker/workspace/obj-build/dom/base/./../../../../checkouts/gecko/dom/base/nsINode.cpp:789:26
#6 0x788a16194440 in nsINode::IsSelected(unsigned int, unsigned int, mozilla::dom::SelectionNodeCache*) const /builds/worker/workspace/obj-build/dom/base/./../../../../checkouts/gecko/dom/base/nsINode.cpp:895:20
#7 0x788a1a3fd692 in nsTextFrame::IsFrameSelected() const /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsTextFrame.cpp:8564:23
#8 0x788a1a3ec314 in IsSelected /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.h:4073:64
#9 0x788a1a3ec314 in nsTextFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsTextFrame.cpp:5247:10
#10 0x788a1a2e3a60 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:4714:14
#11 0x788a1a2cae2f in DisplayLine(mozilla::nsDisplayListBuilder*, GenericLineListIterator<nsLineLink, false>&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&, bool&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:8135:13
#12 0x788a1a2c9520 in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:8375:9
#13 0x788a1a2e3a60 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:4714:14
#14 0x788a1a2cae2f in DisplayLine(mozilla::nsDisplayListBuilder*, GenericLineListIterator<nsLineLink, false>&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&, bool&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:8135:13
#15 0x788a1a2c9520 in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:8375:9
#16 0x788a1a2e3a60 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:4714:14
#17 0x788a1a2cae2f in DisplayLine(mozilla::nsDisplayListBuilder*, GenericLineListIterator<nsLineLink, false>&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&, bool&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:8135:13
#18 0x788a1a2c9520 in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:8375:9
#19 0x788a1a2e3a60 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:4714:14
#20 0x788a1a2cae2f in DisplayLine(mozilla::nsDisplayListBuilder*, GenericLineListIterator<nsLineLink, false>&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&, bool&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:8135:13
#21 0x788a1a2c9520 in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:8375:9
#22 0x788a1a2e3a60 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:4714:14
#23 0x788a1a2ce738 in nsCanvasFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsCanvasFrame.cpp:392:5
#24 0x788a1a2e3a60 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:4714:14
#25 0x788a1a2862d8 in mozilla::ScrollContainerFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:4245:7
#26 0x788a1a2e3a60 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:4714:14
#27 0x788a1a2a09d9 in mozilla::ViewportFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ViewportFrame.cpp:79:3
#28 0x788a1a3633ee in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:3630:5
#29 0x788a1a20a39e in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsLayoutUtils.cpp:3280:15
#30 0x788a1a189609 in mozilla::PresShell::PaintInternal(nsIFrame*, mozilla::WindowRenderer*, mozilla::PaintInternalFlags) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:6801:5
#31 0x788a1a1a0a48 in mozilla::PresShell::PaintSynchronously() /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:12660:3
#32 0x788a1a140f74 in nsRefreshDriver::PaintIfNeeded() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2659:9
#33 0x788a1a1407a7 in operator() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2574:60
#34 0x788a1a1407a7 in void nsRefreshDriver::RunRenderingPhaseLegacy<nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_14>(mozilla::RenderingPhase, nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_14&&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1281:3
#35 0x788a1a139e36 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2572:3
#36 0x788a1a145341 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:365:13
#37 0x788a1a145341 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:343:7
#38 0x788a1a145240 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:359:5
#39 0x788a1a1450ed in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:946:5
#40 0x788a1a14472a in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:856:5
#41 0x788a1a143a96 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:587:14
#42 0x788a193f74fb in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:64:15
#43 0x788a1969a510 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/dom/ipc/./../../ipc/ipdl/PVsyncChild.cpp:241:78
#44 0x788a1497397c in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/glue/./../ipdl/PBackgroundChild.cpp:4960:32
#45 0x788a1490d5ae in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1797:25
#46 0x788a1490ab24 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::unique_ptr<IPC::Message, std::default_delete<IPC::Message>>) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1723:9
#47 0x788a1490b537 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1512:3
#48 0x788a1490c519 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1614:14
#49 0x788a147e0c07 in mozilla::RunnableTask::Run() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:721:16
#50 0x788a147d61b4 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1360:20
#51 0x788a147d4ce7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1183:15
#52 0x788a147d5165 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:657:36
#53 0x788a147e0389 in operator() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:352:37
#54 0x788a147e0389 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:535:5
#55 0x788a147f4ea3 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThread.cpp:1177:16
#56 0x788a147fabff in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:471:10
#57 0x788a14913463 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessagePump.cpp:105:5
#58 0x788a1486e3c1 in RunHandler /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:364:3
#59 0x788a1486e3c1 in MessageLoop::Run() /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:346:3
#60 0x788a19cf3f18 in nsBaseAppShell::Run() /builds/worker/workspace/obj-build/widget/./../../../checkouts/gecko/widget/nsBaseAppShell.cpp:151:27
#61 0x788a19dd2a24 in nsAppShell::Run() /builds/worker/workspace/obj-build/widget/gtk/./../../../../checkouts/gecko/widget/gtk/nsAppShell.cpp:580:33
#62 0x788a1ae779fb in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:652:20
#63 0x788a14914354 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessagePump.cpp:233:9
#64 0x788a1486e3c1 in RunHandler /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:364:3
#65 0x788a1486e3c1 in MessageLoop::Run() /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:346:3
#66 0x788a1ae77144 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:590:34
#67 0x602d31c8369c in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:469:22
| Reporter | ||
Comment 1•8 days ago
|
||
This has also been detected via live site testing.
Comment 2•7 days ago
|
||
Verified bug as reproducible on mozilla-central 20260814223953-23e1f148280c.
The bug appears to have been introduced in the following build range:
Start: 1d8c624a9d81b5a24c56b5f86abe485288a43265 (20260705201657)
End: d85b17d4d4f8ad3af3a4e57537b525c5fb71b26e (20260706030134)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=1d8c624a9d81b5a24c56b5f86abe485288a43265&tochange=d85b17d4d4f8ad3af3a4e57537b525c5fb71b26e
Updated•7 days ago
|
Comment 3•7 days ago
|
||
:masayuki, since you are the author of the regressor, bug 2014622, could you take a look? Also, could you set the severity field?
For more information, please visit BugBot documentation.
| Assignee | ||
Comment 4•6 days ago
|
||
It seems that this is a bug of nsIFrame::PeekOffset family. Probably, it moved the caret into the anonymous subtree of <details>.
Updated•5 days ago
|
Updated•5 days ago
|
| Assignee | ||
Comment 5•2 days ago
|
||
The content nodes in a UA shadow is not accessible via Selection API
even though they are selectable by user's operation (e.g., dragging
text of the default <summary>). Therefore, Selection::Modify should
not move caret into UA shadow.
Additionally, it shouldn't move selection to content managed by
independent selection. Currently, only TextControlElement has
independent selection. So, we should not allow to move selection
into their UA shadow too.
Updated•2 days ago
|
Updated•2 days ago
|
Comment 7•1 day ago
|
||
| bugherder | ||
Backed out for causing marionette failures @Selection.cpp.
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/62122 for changes under testing/web-platform/tests
Upstream PR merged by moz-wptsync-bot
| Assignee | ||
Comment 12•1 day ago
|
||
Hmm, that means our WebDriver uses wrong API, it's here!
| Assignee | ||
Comment 13•1 day ago
|
||
Ah, but the 3rd argument is always "character", it's fine for now.
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/62127 for changes under testing/web-platform/tests
Upstream PR merged by moz-wptsync-bot
Comment 16•20 hours ago
|
||
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/62153 for changes under testing/web-platform/tests
Comment 18•5 hours ago
|
||
| bugherder | ||
Description
•