Created attachment 572262 [details]
###!!! ASSERTION: mEndOffset is beyond the end of this node: 'static_cast<PRUint32>(mEndOffset) <= aInfo->mChangeEnd', file content/base/src/nsRange.cpp, line 317
Created attachment 572263 [details]
Created attachment 572272 [details] [diff] [review]
The assertion is slightly wrong, it should allow the range offset to be
length + 1. Same problem with the mStartOffset assertion.
Comment on attachment 572272 [details] [diff] [review]
Ah, range offsets can point to after the last character.
Took some time to figure out...