1907464 - Assertion failure: startContent->IsInComposedDoc(), at /builds/worker/checkouts/gecko/dom/base/Selection.cpp:1821

Status: RESOLVED FIXED

(Core :: DOM: Selection, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20240620-81bbe3af9834 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: startContent->IsInComposedDoc(), at /builds/worker/checkouts/gecko/dom/base/Selection.cpp:1821

#0 0x7c86fc94c5ec in mozilla::dom::Selection::SelectFrames(nsPresContext*, mozilla::dom::AbstractRange&, bool) const /builds/worker/checkouts/gecko/dom/base/Selection.cpp:1821:3
#1 0x7c86fc94b869 in mozilla::dom::Selection::Clear(nsPresContext*) /builds/worker/checkouts/gecko/dom/base/Selection.cpp:1364:5
#2 0x7c86fc9463a5 in mozilla::dom::Selection::RemoveAllRangesInternal(mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Selection.cpp:2301:3
#3 0x7c87009ae10d in nsWebBrowserFind::SearchInFrame(nsPIDOMWindowOuter*, bool, bool*) /builds/worker/checkouts/gecko/toolkit/components/find/nsWebBrowserFind.cpp:671:10
#4 0x7c87009ad5b6 in nsWebBrowserFind::FindNext(bool*) /builds/worker/checkouts/gecko/toolkit/components/find/nsWebBrowserFind.cpp:108:8
#5 0x7c86fc66a11e in nsGlobalWindowOuter::FindOuter(nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, bool, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:6464:20
#6 0x7c86fc61ad15 in nsGlobalWindowInner::Find(nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, bool, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:4159:3
#7 0x7c86fd55ddef in mozilla::dom::Window_Binding::find(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./WindowBinding.cpp:6354:36
#8 0x7c86fda25222 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3268:13
#9 0x7c8700daa774 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:491:13
#10 0x7c8700da9f5f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:585:12
#11 0x7c8701865046 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jit/BaselineIC.cpp:1670:10
#12 0x6f192e07a5e  ([anon:js-executable-memory]+0xba5e)

Comment 1

[Mayank Bansal]

Got a crash from the testcase: https://crash-stats.mozilla.org/report/index/eca04053-2dcf-4873-a61d-a03190240712

Comment 2

[Mayank Bansal]

Bisection:
Bug 1881096 - Add tests for shadow-crossing selection r=emilio,jjaschke,dom-core

Differential Revision: https://phabricator.services.mozilla.com/D212930

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1881096

:sefeng, since you are the author of the regressor, bug 1881096, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 4

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 1907464 using build mozilla-central 20240620040816-81bbe3af9834. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 5

[Sean Feng [:sefeng211]]

Attachment: Bug 1907464 - Clear the shadow-crossing selection when the ParentChainChanged notification is called on the common ancestor

It's unclear from the spec about where the new selection should be,
so we just clear the selection at the moment.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0825e43199d2
Clear the shadow-crossing selection when the ParentChainChanged notification is called on the common ancestor r=jjaschke,dom-core

Comment 7

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/0825e43199d2

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:sefeng, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox129 to wontfix.

For more information, please visit BugBot documentation.

Comment 9

[Sean Feng [:sefeng211]]

No need to uplift for nightly only feature :)