Before the crash, I see this assertion: ###!!! ASSERTION: Null current node in an iterator that's not done!: 'mCurNode', file /Users/admin/trunk/mozilla/content/base/src/nsContentIterator.cpp, line 1186
Bug 336081 is similar.
Created attachment 256264 [details] testcase The testcase as-is doesn't work because it hits WRONG_DOCUMENT_ERR when trying to move nodes into the iframe, because of the change in bug 47903. Once I fix that, it runs into NS_ERROR_DOM_RANGE_BAD_BOUNDARYPOINTS_ERR when trying to create the second range, thanks to the change in bug 336381. (I even tried changing it to create r2 while its endpoints are still in the document. Still no crash.)
Attachment #220297 - Attachment is obsolete: true
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED
Crash Signature: [@ nsHTMLEditor::GetInlinePropertyBase]
You need to log in before you can comment on or make changes to this bug.