Closed Bug 1803626 Opened 3 years ago Closed 2 years ago

crash near null in [@ mozilla::HTMLEditor::AlignNodesAndDescendants]

Categories

(Core :: DOM: Editor, defect, P3)

Product:
Core
Component:
DOM: Editor
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
109 Branch
Tracking Flags:
Tracking Status
firefox-esr102 --- unaffected
firefox107 --- wontfix
firefox108 --- wontfix
firefox109 --- verified

People

(Reporter: tsmith, Assigned: masayuki)

References

(Depends on 1 open bug, Blocks 1 open bug, Regression)

Details

(Keywords: crash, regression, testcase, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])

Crash Data

Attachments

(2 files)

testcase.html
380 bytes, text/html
Details
Bug 1803626 - Make `HTMLEditor::AlignNodesAndDescendants` check whether insertion point stays valid r=m_kato!
48 bytes, text/x-phabricator-request
Details | Review
Attached file testcase.html —

Found while fuzzing 20221130-d31b862d069a (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

==29102==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000020 (pc 0x7f8cbf6f6248 bp 0x7ffe45f66330 sp 0x7ffe45f66330 T0)
==29102==The signal is caused by a READ memory access.
==29102==Hint: address points to the zero page.
    #0 0x7f8cbf6f6248 in get /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:286:27
    #1 0x7f8cbf6f6248 in operator-> /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:316:12
    #2 0x7f8cbf6f6248 in nsINode::NodeType() const /builds/worker/workspace/obj-build/dist/include/nsINode.h:746:38
    #3 0x7f8cc6285d49 in mozilla::HTMLEditUtils::CanNodeContain(nsINode const&, nsAtom&) /gecko/editor/libeditor/HTMLEditUtils.h:226:21
    #4 0x7f8cc62d605b in mozilla::HTMLEditor::AlignNodesAndDescendants(nsTArray<mozilla::OwningNonNull<nsIContent>>&, nsTSubstring<char16_t> const&, mozilla::dom::Element const&) /gecko/editor/libeditor/HTMLEditSubActionHandler.cpp:6687:12
    #5 0x7f8cc62d365d in mozilla::HTMLEditor::AlignContentsAtRanges(mozilla::AutoRangeArray&, nsTSubstring<char16_t> const&, mozilla::dom::Element const&) /gecko/editor/libeditor/HTMLEditSubActionHandler.cpp:6445:7
    #6 0x7f8cc62d2782 in mozilla::HTMLEditor::AlignAsSubAction(nsTSubstring<char16_t> const&, mozilla::dom::Element const&) /gecko/editor/libeditor/HTMLEditSubActionHandler.cpp:6280:8
    #7 0x7f8cc630e3b6 in mozilla::HTMLEditor::AlignAsAction(nsTSubstring<char16_t> const&, nsIPrincipal*) /gecko/editor/libeditor/HTMLEditor.cpp:2908:7
    #8 0x7f8cc09118c0 in mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) /gecko/dom/base/Document.cpp:5470:27
    #9 0x7f8cc24abd05 in mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/DocumentBinding.cpp:4149:36
    #10 0x7f8cc296f495 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /gecko/dom/bindings/BindingUtils.cpp:3287:13
    #11 0x7f8ccb37d78f in CallJSNative /gecko/js/src/vm/Interpreter.cpp:459:13
    #12 0x7f8ccb37d78f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:547:12
    #13 0x7f8ccb36c70c in InternalCall /gecko/js/src/vm/Interpreter.cpp:614:10
    #14 0x7f8ccb36c70c in CallFromStack /gecko/js/src/vm/Interpreter.cpp:619:10
    #15 0x7f8ccb36c70c in Interpret(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:3375:16
    #16 0x7f8ccb35003c in js::RunScript(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:431:13
    #17 0x7f8ccb37d8ba in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:579:13
    #18 0x7f8ccb37f5ef in InternalCall /gecko/js/src/vm/Interpreter.cpp:614:10
    #19 0x7f8ccb37f5ef in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:646:8
    #20 0x7f8ccb483105 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/CallAndConstruct.cpp:117:10
    #21 0x7f8cc25781ce in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventListenerBinding.cpp:62:8
    #22 0x7f8cc33e3745 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:65:12
    #23 0x7f8cc33e3203 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /gecko/dom/events/EventListenerManager.cpp:1311:43
    #24 0x7f8cc33e4afb in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /gecko/dom/events/EventListenerManager.cpp:1507:17
    #25 0x7f8cc33d2a22 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /gecko/dom/events/EventDispatcher.cpp:347:17
    #26 0x7f8cc33d12d4 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /gecko/dom/events/EventDispatcher.cpp:549:16
    #27 0x7f8cc33d544d in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /gecko/dom/events/EventDispatcher.cpp:1118:11
    #28 0x7f8cc33db105 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /gecko/dom/events/EventDispatcher.cpp
    #29 0x7f8cc0cbfa43 in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /gecko/dom/base/nsINode.cpp:1373:17
    #30 0x7f8cc33f1ce3 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&) /gecko/dom/events/EventTarget.cpp:180:13
    #31 0x7f8cc335aded in mozilla::AsyncEventDispatcher::Run() /gecko/dom/events/AsyncEventDispatcher.cpp:69:12
    #32 0x7f8cc06001da in nsContentUtils::RemoveScriptBlocker() /gecko/dom/base/nsContentUtils.cpp:5917:17
    #33 0x7f8cc092a39f in mozilla::dom::Document::EndUpdate() /gecko/dom/base/Document.cpp:7776:3
    #34 0x7f8cc0550146 in mozAutoDocUpdate::~mozAutoDocUpdate() /gecko/dom/base/mozAutoDocUpdate.h:34:18
    #35 0x7f8cc09a5dac in mozilla::dom::Element::SetAttr(int, nsAtom*, nsAtom*, nsTSubstring<char16_t> const&, nsIPrincipal*, bool) /gecko/dom/base/Element.cpp:2489:1
    #36 0x7f8cc288b3d5 in SetAttr /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Element.h:955:12
    #37 0x7f8cc288b3d5 in SetAttr /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Element.h:951:12
    #38 0x7f8cc288b3d5 in SetAttr /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Element.h:1625:14
    #39 0x7f8cc288b3d5 in SetHTMLAttr /gecko/dom/html/nsGenericHTMLElement.h:760:5
    #40 0x7f8cc288b3d5 in mozilla::dom::HTMLLIElement::SetType(nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/HTMLLIElement.h:36:5
    #41 0x7f8cc288b18f in mozilla::dom::HTMLLIElement_Binding::set_type(JSContext*, JS::Handle<JSObject*>, void*, JSJitSetterCallArgs) /builds/worker/workspace/obj-build/dom/bindings/HTMLLIElementBinding.cpp:160:24
    #42 0x7f8cc296ab37 in bool mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::NormalThisPolicy>(JSContext*, unsigned int, JS::Value*) /gecko/dom/bindings/BindingUtils.cpp:3235:8
    #43 0x7f8ccb37d78f in CallJSNative /gecko/js/src/vm/Interpreter.cpp:459:13
    #44 0x7f8ccb37d78f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:547:12
    #45 0x7f8ccb37f5ef in InternalCall /gecko/js/src/vm/Interpreter.cpp:614:10
    #46 0x7f8ccb37f5ef in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:646:8
    #47 0x7f8ccb381050 in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /gecko/js/src/vm/Interpreter.cpp:790:10
    #48 0x7f8ccb692b96 in SetExistingProperty(JSContext*, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<js::NativeObject*>, js::PropertyResult const&, JS::ObjectOpResult&) /gecko/js/src/vm/NativeObject.cpp:2549:8
    #49 0x7f8ccb6906e8 in bool js::NativeSetProperty<(js::QualifiedBool)1>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /gecko/js/src/vm/NativeObject.cpp:2583:14
    #50 0x7f8ccb367e06 in SetProperty /gecko/js/src/vm/ObjectOperations-inl.h:306:10
    #51 0x7f8ccb367e06 in SetObjectElementOperation /gecko/js/src/vm/Interpreter.cpp:1861:10
    #52 0x7f8ccb367e06 in Interpret(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:3121:12
    #53 0x7f8ccb35003c in js::RunScript(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:431:13
    #54 0x7f8ccb37d8ba in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:579:13
    #55 0x7f8ccb37f5ef in InternalCall /gecko/js/src/vm/Interpreter.cpp:614:10
    #56 0x7f8ccb37f5ef in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:646:8
    #57 0x7f8ccb483105 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/CallAndConstruct.cpp:117:10
    #58 0x7f8cc25735df in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventHandlerBinding.cpp:65:37
    #59 0x7f8cc341f664 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget>>(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:82:12
    #60 0x7f8cc341dc34 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /gecko/dom/events/JSEventHandler.cpp:201:12
    #61 0x7f8cc33e329c in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /gecko/dom/events/EventListenerManager.cpp:1317:22
    #62 0x7f8cc33e4afb in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /gecko/dom/events/EventListenerManager.cpp:1507:17
    #63 0x7f8cc33d2a22 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /gecko/dom/events/EventDispatcher.cpp:347:17
    #64 0x7f8cc33d12d4 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /gecko/dom/events/EventDispatcher.cpp:549:16
    #65 0x7f8cc33d544d in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /gecko/dom/events/EventDispatcher.cpp:1118:11
    #66 0x7f8cc672646e in nsDocumentViewer::LoadComplete(nsresult) /gecko/layout/base/nsDocumentViewer.cpp:1079:7
    #67 0x7f8cca054bfc in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /gecko/docshell/base/nsDocShell.cpp:6451:20
    #68 0x7f8cca053a48 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /gecko/docshell/base/nsDocShell.cpp:5844:7
    #69 0x7f8cca0561a6 in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /gecko/docshell/base/nsDocShell.cpp
    #70 0x7f8cbf43da13 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /gecko/uriloader/base/nsDocLoader.cpp:1380:3
    #71 0x7f8cbf43c485 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /gecko/uriloader/base/nsDocLoader.cpp:978:14
    #72 0x7f8cbf438ea5 in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /gecko/uriloader/base/nsDocLoader.cpp:797:9
    #73 0x7f8cbf43b039 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /gecko/uriloader/base/nsDocLoader.cpp:680:5
    #74 0x7f8cca09b50a in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /gecko/docshell/base/nsDocShell.cpp:13864:23
    #75 0x7f8cbdaf4242 in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /gecko/netwerk/base/nsLoadGroup.cpp:628:22
    #76 0x7f8cbdaf6bd4 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /gecko/netwerk/base/nsLoadGroup.cpp:532:10
    #77 0x7f8cc0953071 in mozilla::dom::Document::DoUnblockOnload() /gecko/dom/base/Document.cpp:11503:18
    #78 0x7f8cc09035fe in mozilla::dom::Document::UnblockOnload(bool) /gecko/dom/base/Document.cpp:11441:9
    #79 0x7f8cc092bd44 in mozilla::dom::Document::DispatchContentLoadedEvents() /gecko/dom/base/Document.cpp:7968:3
    #80 0x7f8cc0a1e1da in applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1162:12
    #81 0x7f8cc0a1e1da in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1168:12
    #82 0x7f8cc0a1e1da in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1215:13
    #83 0x7f8cbd73998f in mozilla::SchedulerGroup::Runnable::Run() /gecko/xpcom/threads/SchedulerGroup.cpp:140:20
    #84 0x7f8cbd74ce79 in mozilla::RunnableTask::Run() /gecko/xpcom/threads/TaskController.cpp:538:16
    #85 0x7f8cbd743f37 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:851:26
    #86 0x7f8cbd7411b8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:683:15
    #87 0x7f8cbd7418e0 in mozilla::TaskController::ProcessPendingMTTask(bool) /gecko/xpcom/threads/TaskController.cpp:461:36
    #88 0x7f8cbd752f81 in operator() /gecko/xpcom/threads/TaskController.cpp:187:37
    #89 0x7f8cbd752f81 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_2>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:546:5
    #90 0x7f8cbd7761b0 in nsThread::ProcessNextEvent(bool, bool*) /gecko/xpcom/threads/nsThread.cpp:1204:16
    #91 0x7f8cbd780944 in NS_ProcessNextEvent(nsIThread*, bool) /gecko/xpcom/threads/nsThreadUtils.cpp:474:10
    #92 0x7f8cbeee501e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /gecko/ipc/glue/MessagePump.cpp:85:21
    #93 0x7f8cbed689b7 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:381:10
    #94 0x7f8cbed689b7 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:374:3
    #95 0x7f8cbed689b7 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:356:3
    #96 0x7f8cc600b7d9 in nsBaseAppShell::Run() /gecko/widget/nsBaseAppShell.cpp:150:27
    #97 0x7f8ccaf679e8 in XRE_RunAppShell() /gecko/toolkit/xre/nsEmbedFunctions.cpp:884:20
    #98 0x7f8cbed689b7 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:381:10
    #99 0x7f8cbed689b7 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:374:3
    #100 0x7f8cbed689b7 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:356:3
    #101 0x7f8ccaf669b5 in XRE_InitChildProcess(int, char**, XREChildData const*) /gecko/toolkit/xre/nsEmbedFunctions.cpp:743:34
    #102 0x55dc6631d2d4 in content_process_main(mozilla::Bootstrap*, int, char**) /gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #103 0x55dc6631d797 in main /gecko/browser/app/nsBrowserApp.cpp:359:18
    #104 0x7f8cdfadc082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #105 0x55dc6625bd58 in _start (/home/worker/builds/m-c-20221130161153-fuzzing-asan-opt/firefox+0x111d58) (BuildId: 3aab1ff5e79cd5294002ec070a44e3c7054e056a)
Flags: in-testsuite?

Got a crash from the testcase : https://crash-stats.mozilla.org/report/index/009c1fef-c8e3-41af-83dc-fc5c80221201
The signature is a bit different.

Crash Signature: [@ RefPtr<T>::get | RefPtr<T>::operator-> | nsINode::NodeType ]

Verified bug as reproducible on mozilla-central 20221201161829-4ec5232d1c53.
The bug appears to have been introduced in the following build range:

Start: 1b8f84b953c5ea7b512f4f0fe7228eeb5523ac30 (20220922060235)
End: c9041757a18ac481d701af85012d9c7c9720db7a (20220922080430)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=1b8f84b953c5ea7b512f4f0fe7228eeb5523ac30&tochange=c9041757a18ac481d701af85012d9c7c9720db7a

Keywords: regression
Whiteboard: [bugmon:bisected,confirmed]

I'll take a look in early next week.

Odd. The logic has been broken by the change in bug 1413181.

Regressed by: 1413181
Assignee: nobody → masayuki
Severity: -- → S3
Status: NEW → ASSIGNED
Priority: -- → P3
OS: Unspecified → All
Hardware: Unspecified → All

In the test case, deleteFromDocument call makes the point unset. We should
make it check whether a legacy mutation event listener creates unexpected result
after calling RemoveAlignFromDescendants.

Pushed by masayuki@d-toybox.com: https://hg.mozilla.org/integration/autoland/rev/f3218564df77 Make `HTMLEditor::AlignNodesAndDescendants` check whether insertion point stays valid r=m_kato
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/37341 for changes under testing/web-platform/tests
Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed], [wptsync upstream]

https://hg.mozilla.org/mozilla-central/rev/f3218564df77

Status: ASSIGNED → RESOLVED
Closed: 2 years ago
status-firefox109: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 109 Branch

Verified bug as fixed on rev mozilla-central 20221207041118-99052dd249cc.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
status-firefox109: fixed → verified
Keywords: bugmon
Upstream PR merged by moz-wptsync-bot
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: