Created attachment 634688 [details] testcase (crashes Firefox when loaded) Messy testcase. I guess some state is not visible to serializeDOMAsScript :/
Crash Signature: [@ nsEditor::CreateTxnForDeleteInsertionPoint ]
Aryeh, can you please take a look?
Assignee: nobody → ayg
Status: NEW → ASSIGNED
This was bug 762183 part 4. It added a while loop to change selectedNode's value, but didn't account for the fact that it might set it to null. Just need a null check here.
Created attachment 634809 [details] [diff] [review] Patch v1 https://tbpl.mozilla.org/?tree=Try&rev=dc65bbdb8a0d
Attachment #634809 - Flags: review?(ehsan)
On Windows: bp-591d4a60-3df4-4f94-8c9f-12fb72120620.
Crash Signature: [@ nsEditor::CreateTxnForDeleteInsertionPoint ] → [@ nsEditor::CreateTxnForDeleteInsertionPoint ] [@ nsEditor::CreateTxnForDeleteInsertionPoint(nsRange*, short, EditAggregateTxn*, nsINode**, int*, int*) ]
OS: Mac OS X → All
Hardware: x86_64 → All
Target Milestone: --- → mozilla16
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.