See upcoming testcase: To reproduce, open testcase: 1. - Open DOM Inspector 2. - Remove html document type of iframe (yellow colored "html" just under #document) 3. - Remove iframe 4. - Press Ctrl-z (undo) 5. - Press Ctrl-z (undo) -> Crash Talkback Id: TB11560652X inLayoutUtils::GetContainerFor [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/extensions/inspector/base/src/inLayoutUtils.cpp, line 252] inDOMUtils::GetParentForNode [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/extensions/inspector/base/src/inDOMUtils.cpp, line 130] inDeepTreeWalker::ParentNode [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/extensions/inspector/base/src/inDeepTreeWalker.cpp, line 188] XPCWrappedNative::CallMethod [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2139] XPC_WN_CallMethod [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1444] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1177] js_Interpret [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3523] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1197] js_Interpret [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3523] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1197] nsXPCWrappedJSClass::CallMethod [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1369] nsXPCWrappedJS::CallMethod [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line 462] SharedStub [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp, line 147] nsTransactionItem::UndoTransaction [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/editor/txmgr/src/nsTransactionItem.cpp, line 197] nsTransactionManager::`vftable' nsTransactionManager::AddRef [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/editor/txmgr/src/nsTransactionManager.cpp, line 104] 0x8b560c45

Well, it seems a regression, somewhere between 2005-06-15 and 2005-07-01. Builds between those dates crash, when unfolding certain elements in the dom inspector, so I can't really pinpoint the regression date. Note that with builds before the regression range, the "(yellow colored "html" just under #document)" thing in step 2 doesn't seem to get deleted, while it seems that that happens in builds after the regression range.

Believe it or not, Martijn, but backing out your patch in bug 297660 fixes the crash. But, it does not, however, cause the deleted html document node to be restored.

Uhm, that's interesting... But it's not like that patch did something weird. I guess it just exposed something that was already broken.

Ok, this is worksforme now with current trunk build. I suspect this was fixed with the fix for bug 285204, but I'm too lazy to check.