Created attachment 634652 [details] testcase ###!!! ASSERTION: GetPriorNode screwed up: '!*outNode || IsDescendantOfEditorRoot(*outNode)', file editor/libeditor/html/nsHTMLEditor.cpp, line 4351
By amazing coincidence, this is perfect motivation for matching the editing spec's definition of "enabled": """ Among commands defined in this specification, those listed in Miscellaneous commands are always enabled, except for the cut command and the paste command. The other commands defined here are enabled if the active range is not null, its start node is either editable or an editing host, its end node is either editable or an editing host, and there is some editing host that is an inclusive ancestor of both its start node and its end node. """ http://dvcs.w3.org/hg/editing/raw-file/tip/editing.html#enabled-commands If we used that definition, most commands would be disabled in cases like this. Then together with bug 760052, this will be fixed.
Created attachment 635653 [details] [diff] [review] Patch v1 This changes GetIsSelectionEditable() to match the spec for nsHTMLEditor (leaving nsEditor's definition unchanged). That requires that some common ancestor of the endpoints be editable, which is not the case here, so we refuse to do anything. Try: https://tbpl.mozilla.org/?tree=Try&rev=a67bf159fa2c
Backed out for now: https://hg.mozilla.org/integration/mozilla-inbound/rev/e23e10a4638b The crashtest here still crashed, because I landed this before bug 760052 (oops). Will reland together with bug 760052.