Steps: 1. Viewer, edit mode 2. select between the '4' and the '5' 3. hit return 4. admire the results of the cool editor InsertBreak method 5. undo (ctrl-z) 6. redo (ctrl-y) crash. aFrame is invalid...it doesn't seem to really point to a frame. maybe it's been inadvertantly Release'd? frames are not ref counted, so this shouldn't happen. stack: nsRangeList::HandleKeyEvent() line 523 + 33 bytes PresShell::HandleEvent() line 1715 nsView::HandleEvent() line 825 nsView::HandleEvent() line 808 nsView::HandleEvent() line 808 nsScrollingView::HandleEvent() line 815 nsView::HandleEvent() line 808 nsViewManager::DispatchEvent() line 1226 HandleEvent() line 64

This looks like a job for supermike. (nsRangeList authored by mike) mike, feel free to kick this back to me if you dont have time for this.

This looks like a job for supermike. (nsRangeList authored by mike) mike, feel free to kick this back to me if you dont have time for this.

still looking at this, I am rather confused.

Changed to M3 milestone

fixed! doesnt crash

not sure what URL/test case you're referring to, but I've been playing inside the editor shell and it looks pretty stable...having tried similar operations outlined below in original bug report. verified in 3/16 build.