+++ This bug was initially created as a clone of Bug #1218032 +++ The patches for bug 1218032 are risky to uplift. On the other hand, the regression causes, bug 1213589 and bug 1215798, are not necessary for Aurora since they are preparation to fix bug 1218032 but bug 1218032 is still being worked on m-c. So, we should back them out from Aurora.

> the regression causes, bug 1213589 and bug 1215798 correct regression bug# is bug 1215798 and bug 1215798's patch depends on it.

Already reviewed in bug 1218032. Approval Request Comment [Feature/regressing bug #]: bug 1215798 (and bug 1215816 depends on it) [User impact if declined]: When modifying DOM tree nodes in rich text editor, user meets the crash (e.g., when removing bold text) [Describe test coverage new/current, TreeHerder]: tested manually and I posted the patches to tryserver: https://treeherder.mozilla.org/#/jobs?repo=try&revision=918eec38037c [Risks and why]: Nothing. The patch isn't necessary for Aurora because it's preparation of bug 1213589 but it's sill not been fixed even on m-c yet. [String/UUID change made/needed]: nothing.

See above. And also this was reviewed in bug 1218032 comment 72.

Comment on attachment 8686446 [details] [diff] [review] part.1 Backout bug 1215816 from Aurora (r=smaug) Backing out a patch to fix a crash, let's uplift to Aurora44.

There is no need to track this bug, it will show up on the right queries used by Sheriffs for Aurora uplifts.

Comment on attachment 8686448 [details] [diff] [review] part.2 Backout bug 1215798 from Aurora (r=smaug) Backout to fix a crash, approved.

Tomcat, Wes: This is a patch was approved a few days back and needs to land soon on Aurora as it addresses a top crash. Please let me know if I can help in anyway.

remote: https://hg.mozilla.org/releases/mozilla-aurora/rev/b5ca0fa6c80c remote: https://hg.mozilla.org/releases/mozilla-aurora/rev/ce2dd840a84e

-> FIXED per comment 8