Closed Bug 1641563 Opened 4 years ago Closed 2 years ago

Assertion failure: !mNextEndRef, at /builds/worker/checkouts/gecko/dom/base/nsRange.cpp:402

Tracking

()

Status:

RESOLVED FIXED

Milestone:

111 Branch

Tracking Flags:

Tracking

Status

firefox-esr78

---

wontfix

firefox-esr102

---

wontfix

firefox78

---

wontfix

firefox82

---

wontfix

firefox83

---

wontfix

firefox84

---

wontfix

firefox109

---

wontfix

firefox110

---

wontfix

firefox111

---

fixed

Tracking

Status

relnote-firefox

thunderbird_esr102

thunderbird_esr115

firefox-esr78

firefox-esr102

firefox-esr115

firefox78

firefox82

firefox83

firefox84

firefox109

firefox110

firefox111

firefox117

firefox118

firefox119

firefox125

firefox123

firefox126

firefox124

People

(Reporter: jkratzer, Assigned: masayuki)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])

Attachments

(2 files)

testcase.html 4 years ago Jason Kratzer [:jkratzer] (deleted), text/html		Details
Bug 1641563 - Add reported test case to WPT r=smaug! 2 years ago Masayuki Nakano [:masayuki] (he/him)(JST, +0900) (deleted), text/x-phabricator-request		Details

Jason Kratzer [:jkratzer]

Reporter

Description

•

4 years ago

Testcase found while fuzzing mozilla-central cfa4bd8e6f78 (built with --enable-debug).

Assertion failure: !mNextEndRef, at /builds/worker/checkouts/gecko/dom/base/nsRange.cpp:402

rax = 0x00007fb73da1ae8c   rdx = 0x0000000000000000
rcx = 0x00005559983cfa58   rbx = 0x000055599977d540
rsi = 0x00007fb74ed068b0   rdi = 0x00007fb74ed05680
rbp = 0x00007ffd4b068c70   rsp = 0x00007ffd4b068ba0
r8 = 0x00007fb74ed068b0    r9 = 0x00007fb74fe6c780
r10 = 0x0000000000000002   r11 = 0x0000000000000000
r12 = 0x000055599979aed0   r13 = 0x00007ffd4b068ca0
r14 = 0x00007ffd4b068d50   r15 = 0x0000555999725480
rip = 0x00007fb7367dfecb
OS|Linux|0.0.0 Linux 5.3.0-51-generic #44~18.04.2-Ubuntu SMP Thu Apr 23 14:27:18 UTC 2020 x86_64
CPU|amd64|family 6 model 94 stepping 3|8
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|nsRange::CharacterDataChanged(nsIContent*, CharacterDataChangeInfo const&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsRange.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|402|0x29
0|1|libxul.so|mozilla::dom::MutationObservers::NotifyCharacterDataChanged(nsIContent*, CharacterDataChangeInfo const&)|hg:hg.mozilla.org/mozilla-central:dom/base/MutationObservers.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|143|0x19
0|2|libxul.so|mozilla::dom::CharacterData::SetTextInternal(unsigned int, unsigned int, char16_t const*, unsigned int, bool, CharacterDataChangeInfo::Details*)|hg:hg.mozilla.org/mozilla-central:dom/base/CharacterData.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|325|0xb
0|3|libxul.so|mozilla::dom::CharacterData::SetData(nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/CharacterData.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|143|0x15
0|4|libxul.so|mozilla::EditorBase::DoSetText(mozilla::dom::Text&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/EditorBase.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|2110|0x13
0|5|libxul.so|mozilla::EditorBase::SetTextNodeWithoutTransaction(nsTSubstring<char16_t> const&, mozilla::dom::Text&)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/EditorBase.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|2718|0x11
0|6|libxul.so|mozilla::TextEditor::SetTextWithoutTransaction(nsTSubstring<char16_t> const&)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/TextEditSubActionHandler.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|710|0x1a
0|7|libxul.so|mozilla::TextEditor::SetTextAsSubAction(nsTSubstring<char16_t> const&)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/TextEditor.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|572|0xb
0|8|libxul.so|mozilla::TextEditor::SetTextAsAction(nsTSubstring<char16_t> const&, nsIPrincipal*)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/TextEditor.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|446|0xb
0|9|libxul.so|mozilla::TextControlState::SetValueWithTextEditor(mozilla::AutoTextControlHandlingState&)|hg:hg.mozilla.org/mozilla-central:dom/html/TextControlState.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|2821|0x1d
0|10|libxul.so|mozilla::TextControlState::SetValue(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const*, unsigned int)|hg:hg.mozilla.org/mozilla-central:dom/html/TextControlState.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|2658|0x8
0|11|libxul.so|mozilla::dom::HTMLTextAreaElement::SetValueInternal(nsTSubstring<char16_t> const&, unsigned int)|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLTextAreaElement.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|312|0xd
0|12|libxul.so|mozilla::dom::HTMLTextAreaElement::Reset()|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLTextAreaElement.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|690|0x10
0|13|libxul.so|mozilla::dom::HTMLTextAreaElement::ContentChanged(nsIContent*)|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLTextAreaElement.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|890|0x8
0|14|libxul.so|mozilla::dom::MutationObservers::NotifyContentAppended(nsIContent*, nsIContent*)|hg:hg.mozilla.org/mozilla-central:dom/base/MutationObservers.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|183|0x16
0|15|libxul.so|nsINode::InsertChildBefore(nsIContent*, nsIContent*, bool)|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|1542|0x8
0|16|libxul.so|mozilla::dom::Text::SplitText(unsigned int, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/Text.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|56|0x20
0|17|libxul.so|mozilla::dom::Text_Binding::splitText(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&)|s3:gecko-generated-sources:e3ef65cbcff98dad0e2aaa7c82758686fb1e9a6d92f78df5e6092df84201c3da95a2760837367ddc5042e1fd54ac97a7479581bc174a138ca5cfeb73f2c2f1e5/dom/bindings/TextBinding.cpp:|58|0x11
0|18|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|3192|0x21
0|19|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|493|0x12
0|20|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|585|0xe
0|21|libxul.so|Interpret(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|652|0xa
0|22|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|465|0xb
0|23|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|620|0x8
0|24|libxul.so|<name omitted>|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|665|0xb
0|25|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|2840|0x23
0|26|libxul.so|mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)|s3:gecko-generated-sources:2563ad09677feb8ddf64827a409899848ef6a80bfacaa11f581c512536a6fb0c779d8b29517ba6358a054c6d475f770bf7bac2913a941d0394881c5649b08603/dom/bindings/EventListenerBinding.cpp:|55|0xe
0|27|libxul.so|void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:99837b3cdc69c5eb1234f9d2b3e771dcff734d56a022bedb1d00c0cf4ee6243fb5c91397a058f2ddab63bda8ed6b581ea1232a0229033866910c7289d24cbc2d/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x21
0|28|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|1082|0x2c
0|29|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|1280|0x16
0|30|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|356|0xb
0|31|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|558|0x19
0|32|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|1055|0x5
0|33|libxul.so|nsDocumentViewer::LoadComplete(nsresult)|hg:hg.mozilla.org/mozilla-central:layout/base/nsDocumentViewer.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|1147|0x1c
0|34|libxul.so|nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|5822|0x18
0|35|libxul.so|nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|5564|0xb
0|36|libxul.so|non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|0|0x10
0|37|libxul.so|nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|1367|0x2b
0|38|libxul.so|nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|927|0x28
0|39|libxul.so|nsDocLoader::DocLoaderIsEmpty(bool)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|747|0xe
0|40|libxul.so|nsDocLoader::OnStopRequest(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|635|0xb
0|41|libxul.so|non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|0|0xd
0|42|libxul.so|mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|615|0x14
0|43|libxul.so|mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|522|0xe
0|44|libxul.so|mozilla::dom::Document::DoUnblockOnload()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|10673|0x1c
0|45|libxul.so|mozilla::dom::Document::UnblockOnload(bool)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|10605|0x8
0|46|libxul.so|mozilla::dom::Document::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|7250|0xd
0|47|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|1237|0x17
0|48|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|146|0x11
0|49|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|1211|0x11
0|50|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|501|0xc
0|51|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|87|0x7
0|52|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|315|0x17
0|53|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|290|0x8
0|54|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|137|0xd
0|55|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|913|0xe
0|56|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|237|0x5
0|57|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|315|0x17
0|58|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|290|0x8
0|59|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|744|0x5
0|60|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|56|0x11
0|61|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|303|0x20
0|62|libc.so.6||||0x21b97
0|63|firefox-bin|<name omitted>|hg:hg.mozilla.org/mozilla-central:mfbt/UniquePtr.h:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|253|0x17

Flags: in-testsuite?

Jason Kratzer [:jkratzer]

Reporter

Updated

•

4 years ago

Keywords: bugmon

Jason Kratzer [:jkratzer]

Reporter

Comment 1

•

4 years ago

Bugmon Analysis: Failed to identify testcase. Please ensure that the testcase meets the requirements identified here: https://github.com/MozillaSecurity/bugmon#testcase-identification Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Jason Kratzer [:jkratzer]

Reporter

Comment 2

•

4 years ago

Attached file testcase.html (deleted) — Details

Jason Kratzer [:jkratzer]

Reporter

Updated

•

4 years ago

Keywords: bugmon

Jason Kratzer [:jkratzer]

Reporter

Updated

•

4 years ago

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

Jason Kratzer [:jkratzer]

Reporter

Comment 3

•

4 years ago

Bugmon Analysis: Verified bug as reproducible on mozilla-central 20200528032513-cfa4bd8e6f78. Failed to bisect testcase (Start build crashes!): > Start: 73c98da145a7c0ef518404493b23a979f328768e (20190530034755) > End: cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f (20200528032513) > BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=False, coverage=False, valgrind=False)

Tyson Smith [:tsmith]

Comment 6

•

4 years ago

A Pernosco session is available here: https://pernos.co/debug/aPMj7B_y7NGwMuiOzTQ2jQ/index.html

status-firefox78: affected → wontfix

status-firefox82: --- → wontfix

status-firefox83: --- → affected

status-firefox84: --- → affected

status-firefox-esr78: --- → affected

Jens Stutte [:jstutte]

Comment 7

•

4 years ago

The assertion in question has been introduced/changed in bug 1380367. Does this ring a bell, :smaug?

Flags: needinfo?(bugs)

See Also: → https://bugzilla.mozilla.org/show_bug.cgi?id=1380367

Kagami [:saschanaz] (they/them, PTO until 2023-09-10)

Updated

•

4 years ago

Blocks: 1697620

BMO Automation

Updated

•

2 years ago

Severity: normal → S3

Bugmon [:jkratzer for issues]

Comment 8

•

2 years ago

Testcase crashes using the initial build (mozilla-central 20220205014840-e8991d00a1d1) but not with tip (mozilla-central 20230203160655-a356e2d3cf46.)

The bug appears to have been fixed in the following build range:

Start: f75c73066b887c2379158c73c994b5ef95460238 (20230127094652)
End: e001f4e845a43564f0588adee16baf8044c74fcb (20230127050229)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=f75c73066b887c2379158c73c994b5ef95460238&tochange=e001f4e845a43564f0588adee16baf8044c74fcb

jkratzer, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Flags: needinfo?(smaug) → needinfo?(jkratzer)

Keywords: bugmon

Jason Kratzer [:jkratzer]

Reporter

Comment 9

•

2 years ago

:masayuki, was this fixed via bug 822734?

Flags: needinfo?(jkratzer) → needinfo?(masayuki)

Masayuki Nakano [:masayuki] (he/him)(JST, +0900)

Assignee

Comment 10

•

2 years ago

Yeah, it uses Text::SplitText, so this must be caused by same bug. I'll add the testcase into WPT.

Assignee: nobody → masayuki

Status: NEW → ASSIGNED

status-firefox83: affected → wontfix

status-firefox84: affected → wontfix

Depends on: 822734

Flags: needinfo?(masayuki)

Masayuki Nakano [:masayuki] (he/him)(JST, +0900)

Assignee

Updated

•

2 years ago

status-firefox-esr78: affected → wontfix

Masayuki Nakano [:masayuki] (he/him)(JST, +0900)

Assignee

Comment 11

•

2 years ago

Attached file Bug 1641563 - Add reported test case to WPT r=smaug! (deleted) — Details

The bug itself was fixed in bug 822734.

The reported test case of bug 1641563 does not require invalid HTML structure,
and using simpler Selection API. Therefore, it's worthwhile to add the test
into WPT.

Pulsebot

Comment 12

•

2 years ago

Pushed by masayuki@d-toybox.com: https://hg.mozilla.org/integration/autoland/rev/5cea0d162bb2 Add reported test case to WPT r=smaug

Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)

Comment 13

•

2 years ago

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/38390 for changes under testing/web-platform/tests

Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)

Updated

•

2 years ago

Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed], [wptsync upstream]

Natalia Csoregi [:nataliaCs]

Comment 14

•

2 years ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/5cea0d162bb2

Status: ASSIGNED → RESOLVED

Closed: 2 years ago

status-firefox111: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → 111 Branch

Ryan VanderMeulen [:RyanVM]

Updated

•

2 years ago

status-firefox109: --- → wontfix

status-firefox110: --- → wontfix

status-firefox-esr102: --- → wontfix

Flags: in-testsuite? → in-testsuite+

Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)

Comment 15

•

2 years ago

Upstream PR merged by moz-wptsync-bot

You need to log in before you can comment on or make changes to this bug.