Created attachment 634625 [details] testcase ###!!! ASSERTION: bad args: '(aChild && aParent)', file editor/libeditor/base/nsEditor.cpp, line 3139
Created attachment 634628 [details] stack trace+ aParent is null. (By the way, asserting a conjunction results in vague error logs. I prefer two separate assertions.)
Aryeh, can you please take a look? Seems easy to fix.
This is another case where we should just be returning false and refusing to try to do anything at all. insertHTML is not enabled here -- bug 760052.
(But we can do more explicit null-checking too.)
Created attachment 635210 [details] [diff] [review] Patch v1 This patch actually keeps the NS_ASSERTION. The real fix is bug 760052, which refuses the run the command to start with in such a pathological case. However, as usual, I rewrote the relevant function while trying to figure out what was happening. This function was pathological even by editor/ standards, particularly the variable naming. There were only three callers. Two ignored the out params and just relied on the fact that the selection would be in roughly the right place, so I got rid of the out params and just put the selection in the right place to start with. In the new function I use both MOZ_ASSERT and NS_ASSERTION, based on how pathological I felt the error case would be. In all cases I also checked for the error in non-debug builds and did basic handling, so that if they do fail we won't crash or anything. Really it would probably make more sense for this to be renamed SplitSelection() or something and the delete part moved out. One of the callers doesn't use the delete behavior anyway because it wants different eStrip/eNoStrip behavior. Try: https://tbpl.mozilla.org/?tree=Try&rev=e28d01ae0a94
https://hg.mozilla.org/integration/mozilla-inbound/rev/66b3801292a0 This is actually not in the testsuite yet, I just realized. I'll add the testcase to bug 760052, so marking in-testsuite+.
Backed out for now: https://hg.mozilla.org/integration/mozilla-inbound/rev/b507d9bfcd04 MOZ_ASSERT(node, "Selection has no ranges in it"); was causing crashtest failures because bug 760052 hasn't landed yet. Will reland after bug 760052.