Created attachment 553549 [details] testcase ###!!! ASSERTION: mEndOffset is beyond the end of this node: 'static_cast<PRUint32>(mEndOffset) <= aInfo->mChangeEnd', file content/base/src/nsRange.cpp, line 305
I added this assertion in bug 191864. I'll investigate...
Created attachment 558235 [details] [diff] [review] fix The problem is that nsRange::CutContents uses SplitData internally in a different way than splitText, in some case it removes the new node: http://mxr.mozilla.org/mozilla-central/source/content/base/src/nsRange.cpp#1395 Calling SetTextInternal with NULL in that case makes us use the old path in nsRange::CharacterDataChanged that doesn't try to change the boundary point.
Created attachment 559078 [details] [diff] [review] regression test