Open sample 0 SelectAll (ctrl-a) Del crash. "aFrame" is garbage. Stack: PresShell::ScrollFrameIntoView(const PresShell * const 0x01356520, nsIFrame * 0x01399550, int 0, unsigned int 17, int 0, unsigned int 20) line 1425 + 17 bytes PresShell::ScrollFrameIntoView(PresShell * const 0x0135652c, nsIFrame * 0x01399550) line 966 + 31 bytes nsRangeList::ScrollIntoView(nsRangeList * const 0x013565f0, nsIFocusTracker * 0x0135652c) line 1114 + 16 bytes nsRangeList::ResetSelection(nsRangeList * const 0x013565f0, nsIFocusTracker * 0x0135652c, nsIFrame * 0x01373ab0) line 1040 + 16 bytes PresShell::NotifySelectionChanged(PresShell * const 0x01356530) line 994 nsRangeList::NotifySelectionListeners() line 1136 + 23 bytes nsRangeList::EndBatchChanges(nsRangeList * const 0x013565f4) line 1097 nsEditor::Do(nsEditor * const 0x0136f6b0, nsITransaction * 0x0138e7b0) line 656 nsEditor::DeleteSelection(nsEditor * const 0x0136f6b0, nsIEditor::Direction eLTR) line 1202 + 16 bytes nsTextEditor::DeleteSelection(nsTextEditor * const 0x0136f6b0, nsIEditor::Direction eLTR) line 386 nsHTMLEditor::DeleteSelection(nsHTMLEditor * const 0x0136f6b0, nsIEditor::Direction eLTR) line 117 nsTextEditorKeyListener::KeyDown(nsIDOMEvent * 0x0138e770) line 146

You will not be able to see this bug until after my next check-in. If you want, you can grab my editor code from \\Techno\Transfer\buster\editor.

Changed to M3 milestone

Kin discovered the problem here and Mike has the fix. Assigning to Mike.

fixed! small change to nsFrame.cpp

verified in 3/16 build.