Now, you can specify where to put the insertion point when you reply to a message. If you set the following pref: user_pref("mailnews.reply_on_top", 0); The cursor should go at the end of the reply message. But when I call editor->EndOfDocument (nsMsgCompose.cpp, line 147), we hit an infinity loop that frozen the application.

I see this on Linux, too, and have a stack trace: #0 0x40166da1 in nsTraceRefcnt::LogAddRef (aPtr=0x89945f0, aRefCnt=4, aClazz=0x4118c592 "nsHTMLHtmlElement", classSize=72) at nsTraceRefcnt.cpp:1054 #1 0x40f5b957 in nsHTMLHtmlElement::AddRef (this=0x89945f0) at nsHTMLHtmlElement.cpp:106 #2 0x40f5bc26 in nsHTMLHtmlElement::QueryInterface (this=0x89945f0, aIID=@0x411c4ba0, aInstancePtr=0xbffff26c) at nsHTMLHtmlElement.cpp:113 #3 0x410daf66 in nsContentIterator::CurrentNode (this=0x8999428, aNode=0xbffff26c) at nsContentIterator.cpp:721 #4 0x418b6c0e in nsEditor::GetLastEditableNode (this=0x89df2a8, aRoot=0x8a22a48, outLastNode=0xbffff33c) at nsEditor.cpp:1834 #5 0x418b2186 in nsEditor::EndOfDocument (this=0x89df2a8) at nsEditor.cpp:726 It's looping giving the error: NotReached: "nsContentIterator::PrevNode() : no parent found" at file nsContentIterator.cpp, line 583 Line 583 is preceded by the comment: // a little noise to catch some iterator usage bugs. I'm not sure whether this means that nsEditor::GetLastEditableNode is misusing its content iterator, or if it means that the content iterator is misusing itself.

preface summary with keyword and setting to M12

I'll try to look into this tonight. accepting bug.

I need to uncomment some code in the compose back end when this is working. - rhp

fixed - problem was the usage of an unfinished iterator feature: MakePre(). I rewrote nsEditor::GetFirstEditableNode() and nsEditor::GetLastEditableNode() to not use this iterator feature (indeed to not use iterators at all). It works fine now although the caret might not be where you expect in the EndOfDocument() case: it appears at the end of the quoted text rather on a line after it. However, when you type the new text appears in the right place. I think the caret issue will be fixed by some work I'm checking in later this week.

Verified as fixed on win32, linux, and macos using the following builds: ftp://sweetlou/products/client/seamonkey/windows/32bit/x86/1999-12-06-09-M12/sea monkey32e.exe ftp://sweetlou/products/client/seamonkey/unix/linux_glibc/2.2/x86/1999-12-06-08- M12/netscape-i686-pc-linux-gnu.tar.gz ftp://sweetlou/products/client/seamonkey/macos/8.x/ppc/1999-12-06-08-M12/netscap e5-mac-M12.sea.bin The user pref "user_pref("mailnews.reply_on_top", 0);" does work. 0=put cursor/caret after quoted text. 1=put cursor/caret above quoted text. When the text is quoted, there is a blank line separating the insertion point and quoted text. No crash experienced. Verified as fixed.

fyi, I tested this bug under POP and IMAP using a html and plain text editor.