Closed Bug 1691051 Opened 3 years ago Closed 3 years ago

Assertion failure: GetTopLevelEditSubAction() == EditSubAction::eNone (Initializing during an edit action is an error), at /builds/worker/checkouts/gecko/editor/libeditor/EditorBase.cpp:251

Categories

(Core :: DOM: Editor, defect, P3)

Product:
Core
Component:
DOM: Editor
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
89 Branch
Tracking Flags:
Tracking Status
firefox-esr78 --- unaffected
firefox87 --- wontfix
firefox88 --- wontfix
firefox89 --- verified

People

(Reporter: jkratzer, Assigned: masayuki)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(2 files)

testcase.html
448 bytes, text/html
Details
Bug 1691051 - Make edit action data which is being handled manage whether the editor was temporarily destroyed or not r=m_kato!
48 bytes, text/x-phabricator-request
Details | Review
Attached file testcase.html —

Testcase found while fuzzing mozilla-central rev 48895a7f84a6 (built with --enable-debug).

Assertion failure: GetTopLevelEditSubAction() == EditSubAction::eNone (Initializing during an edit action is an error), at /builds/worker/checkouts/gecko/editor/libeditor/EditorBase.cpp:251

    #0 0x7f204a16c9ce in mozilla::EditorBase::Init(mozilla::dom::Document&, mozilla::dom::Element*, nsISelectionController*, unsigned int, nsTSubstring<char16_t> const&) /builds/worker/checkouts/gecko/editor/libeditor/EditorBase.cpp:250:3
    #1 0x7f204a1e5723 in mozilla::HTMLEditor::Init(mozilla::dom::Document&, mozilla::dom::Element*, nsISelectionController*, unsigned int, nsTSubstring<char16_t> const&) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditor.cpp:242:29
    #2 0x7f204a2b7330 in nsEditingSession::SetupEditorOnWindow(nsPIDOMWindowOuter&) /builds/worker/checkouts/gecko/editor/composer/nsEditingSession.cpp:414:20
    #3 0x7f204a2b5c12 in nsEditingSession::MakeWindowEditable(mozIDOMWindowProxy*, char const*, bool, bool, bool) /builds/worker/checkouts/gecko/editor/composer/nsEditingSession.cpp:163:10
    #4 0x7f20475daded in mozilla::dom::Document::EditingStateChanged() /builds/worker/checkouts/gecko/dom/base/Document.cpp:5742:25
    #5 0x7f20475e9d68 in mozilla::dom::Document::BeginLoad() /builds/worker/checkouts/gecko/dom/base/Document.cpp:7411:5
    #6 0x7f2046cd324c in nsHtml5TreeOpExecutor::WillBuildModel(nsDTDMode) /builds/worker/checkouts/gecko/parser/html/nsHtml5TreeOpExecutor.cpp:156:18
    #7 0x7f2046cc725f in nsHtml5Parser::StartExecutor() /builds/worker/checkouts/gecko/parser/html/nsHtml5Parser.cpp:661:20
    #8 0x7f20475f2a14 in mozilla::dom::Document::Open(mozilla::dom::Optional<nsTSubstring<char16_t> > const&, mozilla::dom::Optional<nsTSubstring<char16_t> > const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Document.cpp:9244:25
    #9 0x7f20475f372d in mozilla::dom::Document::WriteCommon(nsTSubstring<char16_t> const&, bool, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Document.cpp:9400:5
    #10 0x7f20475f32bc in mozilla::dom::Document::WriteCommon(mozilla::dom::Sequence<nsTString<char16_t> > const&, bool, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Document.cpp:9313:5
    #11 0x7f20486204a7 in mozilla::dom::Document_Binding::writeln(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/DocumentBinding.cpp:3230:24
    #12 0x7f204899453a in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3233:13
    #13 0x7f204ba3b4b1 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:503:13
    #14 0x7f204ba3ad44 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:594:12
    #15 0x7f204ba3c463 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:647:10
    #16 0x7f204ba30ec3 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:651:10
    #17 0x7f204ba30ec3 in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3309:16
    #18 0x7f204ba284a8 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:473:13
    #19 0x7f204ba3acae in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:619:13
    #20 0x7f204ba3c463 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:647:10
    #21 0x7f204ba3c69f in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:664:8
    #22 0x7f204bfcb38b in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jsapi.cpp:2861:10
    #23 0x7f20486b62ec in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventListenerBinding.cpp:58:8
    #24 0x7f2048d3b1a6 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:65:12
    #25 0x7f2048d3aeee in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1101:43
    #26 0x7f2048d3bb70 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1298:17
    #27 0x7f2048d30f45 in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:390:5
    #28 0x7f2048d30f45 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:352:17
    #29 0x7f2048d306b5 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:590:14
    #30 0x7f2048d33065 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1089:11
    #31 0x7f20474826db in nsContentUtils::MaybeFireNodeRemoved(nsINode*, nsINode*) /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:4649:5
    #32 0x7f2047768609 in nsINode::RemoveChild(nsINode&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:795:5
    #33 0x7f204a167596 in mozilla::DeleteNodeTransaction::DoTransaction() /builds/worker/checkouts/gecko/editor/libeditor/DeleteNodeTransaction.cpp:77:15
    #34 0x7f204a16942e in mozilla::EditAggregateTransaction::DoTransaction() /builds/worker/checkouts/gecko/editor/libeditor/EditAggregateTransaction.cpp:28:52
    #35 0x7f204a168628 in mozilla::DeleteRangeTransaction::DoTransaction() /builds/worker/checkouts/gecko/editor/libeditor/DeleteRangeTransaction.cpp:87:43
    #36 0x7f204a16942e in mozilla::EditAggregateTransaction::DoTransaction() /builds/worker/checkouts/gecko/editor/libeditor/EditAggregateTransaction.cpp:28:52
    #37 0x7f204a2b1db9 in DoTransaction /builds/worker/checkouts/gecko/editor/txmgr/TransactionItem.cpp:82:30
    #38 0x7f204a2b1db9 in mozilla::TransactionManager::BeginTransaction(nsITransaction*, nsISupports*) /builds/worker/checkouts/gecko/editor/txmgr/TransactionManager.cpp:687:34
    #39 0x7f204a2b1a84 in mozilla::TransactionManager::DoTransaction(nsITransaction*) /builds/worker/checkouts/gecko/editor/txmgr/TransactionManager.cpp:72:8
    #40 0x7f204a15ce0a in mozilla::EditorBase::DoTransactionInternal(nsITransaction*) /builds/worker/checkouts/gecko/editor/libeditor/EditorBase.cpp:854:41
    #41 0x7f204a1809a2 in mozilla::EditorBase::DeleteRangesWithTransaction(short, short, mozilla::AutoRangeArray const&) /builds/worker/checkouts/gecko/editor/libeditor/EditorBase.cpp:3953:17
    #42 0x7f204a21f8cc in mozilla::HTMLEditor::AutoDeleteRangesHandler::HandleDeleteNonCollapsedRanges(mozilla::HTMLEditor&, short, short, mozilla::AutoRangeArray&, mozilla::HTMLEditor::AutoDeleteRangesHandler::SelectionWasCollapsed) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditorDeleteHandler.cpp:2928:33
    #43 0x7f204a21b9b0 in mozilla::HTMLEditor::AutoDeleteRangesHandler::Run(mozilla::HTMLEditor&, short, short, mozilla::AutoRangeArray&) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditorDeleteHandler.cpp:1604:29
    #44 0x7f204a21a5e1 in mozilla::HTMLEditor::HandleDeleteSelection(short, short) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditorDeleteHandler.cpp:1084:43
    #45 0x7f204a17f771 in mozilla::EditorBase::DeleteSelectionAsSubAction(short, short) /builds/worker/checkouts/gecko/editor/libeditor/EditorBase.cpp:3772:7
    #46 0x7f204a1e940c in mozilla::HTMLEditor::InsertBRElementAtSelectionWithTransaction() /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditor.cpp:1240:19
    #47 0x7f204a1e885f in mozilla::HTMLEditor::InsertLineBreakAsAction(nsIPrincipal*) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditor.cpp:1076:8
    #48 0x7f204a18a71c in mozilla::InsertLineBreakCommand::DoCommand(mozilla::Command, mozilla::TextEditor&, nsIPrincipal*) const /builds/worker/checkouts/gecko/editor/libeditor/EditorCommands.cpp:921:44
    #49 0x7f20475dea23 in mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Document.cpp:5166:26
    #50 0x7f2048620d5d in mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/DocumentBinding.cpp:3474:36
    #51 0x7f204899453a in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3233:13
    #52 0x7f204ba3b4b1 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:503:13
    #53 0x7f204ba3ad44 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:594:12
    #54 0x7f204ba3c463 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:647:10
    #55 0x7f204ba30ec3 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:651:10
    #56 0x7f204ba30ec3 in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3309:16
    #57 0x7f204ba284a8 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:473:13
    #58 0x7f204ba3acae in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:619:13
    #59 0x7f204ba3c463 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:647:10
    #60 0x7f204ba3c69f in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:664:8
    #61 0x7f204bfcb38b in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jsapi.cpp:2861:10
    #62 0x7f20486b62ec in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventListenerBinding.cpp:58:8
    #63 0x7f2048d3b1a6 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:65:12
    #64 0x7f2048d3aeee in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1101:43
    #65 0x7f2048d3bb70 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1298:17
    #66 0x7f2048d30f45 in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:390:5
    #67 0x7f2048d30f45 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:352:17
    #68 0x7f2048d304f3 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:554:16
    #69 0x7f2048d33065 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1089:11
    #70 0x7f204a405c4d in nsDocumentViewer::LoadComplete(nsresult) /builds/worker/checkouts/gecko/layout/base/nsDocumentViewer.cpp:1107:7
    #71 0x7f204b3db6c0 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:6510:20
    #72 0x7f204b3db072 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:5867:7
    #73 0x7f204b3dbfff in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp
    #74 0x7f2046c0a24c in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:1332:3
    #75 0x7f2046c097fa in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:938:14
    #76 0x7f2046c07d37 in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:757:9
    #77 0x7f2046c08c7d in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:640:5
    #78 0x7f2046c0941c in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp
    #79 0x7f2045b58a96 in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:616:22
    #80 0x7f2045b59fa3 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:523:10
    #81 0x7f20475fafc1 in mozilla::dom::Document::DoUnblockOnload() /builds/worker/checkouts/gecko/dom/base/Document.cpp:11089:18
    #82 0x7f20475d9e40 in mozilla::dom::Document::UnblockOnload(bool) /builds/worker/checkouts/gecko/dom/base/Document.cpp:11019:9
    #83 0x7f20475ea51c in mozilla::dom::Document::DispatchContentLoadedEvents() /builds/worker/checkouts/gecko/dom/base/Document.cpp:7583:3
    #84 0x7f204765b4a6 in applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1148:12
    #85 0x7f204765b4a6 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1154:12
    #86 0x7f204765b4a6 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1201:13
    #87 0x7f20459ae472 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/checkouts/gecko/xpcom/threads/SchedulerGroup.cpp:146:20
    #88 0x7f20459b4a6f in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:472:16
    #89 0x7f20459b2fe6 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:753:26
    #90 0x7f20459b1e44 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:611:15
    #91 0x7f20459b1ff7 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:395:36
    #92 0x7f20459b8596 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:133:37
    #93 0x7f20459b8596 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_3>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:534:5
    #94 0x7f20459c9a87 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1158:16
    #95 0x7f20459cfeda in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:548:10
    #96 0x7f20462e70c6 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:87:21
    #97 0x7f2046252aa3 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:335:10
    #98 0x7f20462529bd in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:328:3
    #99 0x7f20462529bd in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:310:3
    #100 0x7f204a0b3218 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
    #101 0x7f204b8ff2d3 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:902:20
    #102 0x7f20462e7fac in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:237:9
    #103 0x7f2046252aa3 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:335:10
    #104 0x7f20462529bd in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:328:3
    #105 0x7f20462529bd in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:310:3
    #106 0x7f204b8feea8 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:733:34
    #107 0x55e62b91ff86 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #108 0x55e62b91ff86 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:306:18
    #109 0x7f205c4e50b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
Flags: in-testsuite?

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210205213946-2f575c3c4353.
The bug appears to have been introduced in the following build range:

Start: 3150ac63c05e1b07cd41931dc935643a860f480f (20201016142259)
End: f147e5824108286b1d94373cab168bf69559b25d (20201016142327)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=3150ac63c05e1b07cd41931dc935643a860f480f&tochange=f147e5824108286b1d94373cab168bf69559b25d

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

Masayuki, can you, please, take a look?

Severity: -- → S3
Flags: needinfo?(masayuki)
Regressed by: 1671197
Has Regression Range: --- → yes

Yeah, I'll take a look. I guessed there are some bugs of this pattern.

Priority: -- → P3

I understand what's going on this case.

When document is opened, editing session is temporarily disabled. Then, when the document is closed, the editing session is enabled again. Then, initialization runs again in same HTMLEditor instance. Possible approach to fix this is, I guess that rejects any other edit actions during another edit action except initialization. And then, disables the MOZ_ASSERT.

Assignee: nobody → masayuki
Status: NEW → ASSIGNED
Flags: needinfo?(masayuki)

The editing session is temporarily disabled when opening a document. Then,
when the document is closed, the editing session is restored with same
HTMLEditor instance. Therefore, initializing editor may occur during
an edit action is being handled.

Probably, this must not be used in normal webapps since mutation events are
used rarely. So, I think that for avoiding further complicated things, we
should make editor won't accept new edit action handling after original
editing session ended.

This patch renames AutoEditActionDataSetter::CanHandle() to
IsDataAvailable() since it just checks whether the important resource is
available or not. And makes new CanHandle() return false for
non-initializing edit actions if editing session has ended.

Pushed by masayuki@d-toybox.com:
https://hg.mozilla.org/integration/autoland/rev/6db5aaeb268e
Make edit action data which is being handled manage whether the editor was temporarily destroyed or not r=m_kato

https://hg.mozilla.org/mozilla-central/rev/6db5aaeb268e

Status: ASSIGNED → RESOLVED
Closed: 3 years ago
status-firefox89: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 89 Branch

Since the status are different for nightly and release, what's the status for beta?
For more information, please visit auto_nag documentation.

status-firefox88: --- → ?

Bugmon Analysis:
Verified bug as fixed on rev mozilla-central 20210410033658-f84605e6fc8b.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
status-firefox89: fixed → verified
Keywords: bugmon
Regressions: 1704381
status-firefox87: affected → wontfix
status-firefox88: ? → wontfix
status-firefox-esr78: --- → unaffected
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: