Steps to reproduce: 1. Create two bookmarklets on your personal toolbar with the following URLs: javascript:x = window.open(); void 0 javascript:x.document.body.appendChild (getSelection().getRangeAt (0).cloneContents()); void 0 2. Go to a web site, such as http://www.cs.hmc.edu/~jruderma/s/ or http://www.slashdot.org/. 3. Click the first bookmarklet. This will open a blank, new window. 4. Select some text in the other window. 5. Click the second bookmarklet. Result: If part of one text node is selected, the part *after* that part of the node is copied to the other window. If the selection spans several nodes, nothing is copied. Expected: The text and formatting of the contents of the new window should resemble the text and formatting of the selected portion of the old window.

*** Bug 105862 has been marked as a duplicate of this bug. ***

range bug, re-assigning to kin.

I rewrote nsRange::CloneContents() and nsRangeDeleteContents() to fix the crashers I was seeing in the TestCase attatched to bug 120366 ... A patch is attatched to bug 120366, and I'm currently waiting on reviews before I can check it in. In the meantime I'm moving this bug out to mozilla1.0.1. I tried your bookmarklet examples with my new code and your urls and they work like a charm! :-)

I just checked in a rewrite of CloneContents() and DeleteContents(), into the TRUNK, to fix bug #120366 (Crash in nsRange::CopyContents()). mozilla/content/base/src/nsRange.cpp revision 1.146 mozilla/content/base/src/nsRange.h revision 1.37 That should fix this bug.

Yay, it works! I wrote a "view partial source" bookmarklet (see bug 49721) using range.cloneContents and it works fine.