849745 - Assertion failure: "AncestorHasDirAuto set on node but not its children" with nested dir=auto, comment

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect, P3)

Description

[Jesse Ruderman]

Attachment: testcase (asserts fatally when loaded)

Assertion failure: !aElement->AncestorHasDirAuto() || child->AncestorHasDirAuto() (AncestorHasDirAuto set on node but not its children), at content/base/src/DirectionalityUtils.cpp:684

Comment 1

[Simon Montagu :smontagu]

Attachment: Patch v.1

Wow, I had no idea that comments turn up looking like other child nodes when walking the DOM. Are there other kinds of nodes that we should be excluding here?

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Processing instruction?

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

And does the code handle both TEXT_NODE and CDATA_SECTION_NODE?
(There is some child->NodeType() == nsIDOMNode::TEXT_NODE check).

Comment 4

[(no longer active)]

Comment on attachment 724845 [details] [diff] [review]
Patch v.1

Review of attachment 724845 [details] [diff] [review]:
-----------------------------------------------------------------

Yeah you want to handle PIs too.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Confirmed that current m-c is still affected.

Comment 6

[Firefox Bug Husbandry Bot]

https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Move_fix-optionals

Comment 7

[Tyson Smith [:tsmith]]

This was last seen by the fuzzers in Aug 2018. The attached test case also no longer reproduces the issue.