Created attachment 634652 [details]
###!!! ASSERTION: GetPriorNode screwed up: '!*outNode || IsDescendantOfEditorRoot(*outNode)', file editor/libeditor/html/nsHTMLEditor.cpp, line 4351
Created attachment 634653 [details]
By amazing coincidence, this is perfect motivation for matching the editing spec's definition of "enabled":
Among commands defined in this specification, those listed in Miscellaneous commands are always enabled, except for the cut command and the paste command. The other commands defined here are enabled if the active range is not null, its start node is either editable or an editing host, its end node is either editable or an editing host, and there is some editing host that is an inclusive ancestor of both its start node and its end node.
If we used that definition, most commands would be disabled in cases like this. Then together with bug 760052, this will be fixed.
Created attachment 635653 [details] [diff] [review]
This changes GetIsSelectionEditable() to match the spec for nsHTMLEditor (leaving nsEditor's definition unchanged). That requires that some common ancestor of the endpoints be editable, which is not the case here, so we refuse to do anything.
Backed out for now: https://hg.mozilla.org/integration/mozilla-inbound/rev/e23e10a4638b
The crashtest here still crashed, because I landed this before bug 760052 (oops). Will reland together with bug 760052.
Take two: https://hg.mozilla.org/integration/mozilla-inbound/rev/8a3df3497e8f