772668 - "ASSERTION: aNode isn't in mRange, or something else weird happened" after failed justifyright

Status: NEW

(Core :: DOM: Editor, defect, P5)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: aNode isn't in mRange, or something else weird happened: 'NS_SUCCEEDED(res) && !nodeBefore && !nodeAfter', file content/base/src/nsContentIterator.cpp, line 1437

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Aryeh Gregor (:ayg) (no longer with Mozilla)]

The test case seems awfully obfuscated.  If you're going to use DOM methods instead of just an HTML serialization, you can do stuff like

  document.documentElement.setAttributeNS(null, "contenteditable", "true");
  allNodes[1] = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
  allNodes[1].setAttributeNS(null, "contenteditable", "false");
  allNodes[2] = document.createTextNode("x");
  (allNodes[1] || document.documentElement).appendChild(allNodes[2]);

->

  document.documentElement.contentEditable = true;
  var div = document.createElement("div");
  div.contentEditable = false;
  div.appendChild(document.createTextNode("x"));

What's the || business there even supposed to do?  allNodes[1] is certainly not null, so everything after it will just be ignored . . .

Similarly, this

  window.getSelection().removeAllRanges();
  r0 = document.createRange();
  r0.setStart(allNodes[3], 1);
  r0.setEnd(allNodes[3], 1);
  window.getSelection().addRange(r0);

could be just

  getSelection().collapse(allNodes[3], 1);

This kind of change would make the tests a lot easier to understand . . .

Comment 3

[:ehsan akhgari]

Jesse's test cases are usually auto-generated using a fuzzer.  :-)

Comment 4

[Jesse Ruderman]

Yeah, I usually make those kinds of transformations manually before filing bugs.

This is roughly the form I use for automated reduction.  (The "||" allows the children of a removed node to remain in the document, for example.)

Comment 5

[Jesse Ruderman]

The fix for bug 887631 didn't take care of this one, fwiw.

Comment 6

[Jens Stutte [:jstutte]]

Bulk-downgrade of unassigned, >=5 years untouched DOM/Storage bugs' priority.

If you have reason to believe this is wrong (especially for the severity), please write a comment and ni :jstutte.