Steps to reproduce: 1. Start apprunner -editor 2. Place the cursor in the middle of any line with text. 3. Hit the return key. 4. Hit the backspace key. 5. Do an Undo. Notice how the entire text block disappears? If you try to do a Redo, we crash with the following stack trace because mParent is invalid: nsGenericDOMDataNode::GetParentNode(nsIDOMNode * * 0x0012f5b4) line 96 + 24 bytes nsTextNode::GetParentNode(nsTextNode * const 0x014381a0, nsIDOMNode * * 0x0012f5b4) line 49 + 18 bytes nsTextEditRules::DidRedo(nsTextEditRules * const 0x01390e50, nsIDOMSelection * 0x013ce804, unsigned int 0) line 544 + 59 bytes nsTextEditor::Redo(nsTextEditor * const 0x01390850, unsigned int 1) line 554 + 31 bytes nsHTMLEditor::Redo(nsHTMLEditor * const 0x01390850, unsigned int 1) line 149 nsTextEditorKeyListener::ProcessShortCutKeys(nsIDOMEvent * 0x01440a60, int & 1) line 301 nsTextEditorKeyListener::KeyDown(nsIDOMEvent * 0x01440a60) line 135 nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent * 0x0012fa70, nsIDOMEvent * * 0x0012f7a4, nsEventStatus & nsEventStatus_eIgnore) line 379 + 17 bytes nsDocument::HandleDOMEvent(nsDocument * const 0x01394120, nsIPresContext & {...}, nsEvent * 0x0012fa70, nsIDOMEvent * * 0x0012f7a4, unsigned int 1, nsEventStatus & nsEventStatus_eIgnore) line 1751 nsHTMLHtmlElement::HandleDOMEvent(nsHTMLHtmlElement * const 0x0139484c, nsIPresContext & {...}, nsEvent * 0x0012fa70, nsIDOMEvent * * 0x00000000, unsigned int 1, nsEventStatus & nsEventStatus_eIgnore) line 173 + 41 bytes PresShell::HandleEvent(PresShell * const 0x013ce734, nsIView * 0x01413730, nsGUIEvent * 0x0012fa70, nsEventStatus & nsEventStatus_eIgnore) line 1930 + 34 bytes nsView::HandleEvent(nsView * const 0x01413730, nsGUIEvent * 0x0012fa70, unsigned int 8, nsEventStatus & nsEventStatus_eIgnore) line 825 nsView::HandleEvent(nsView * const 0x013e8bd0, nsGUIEvent * 0x0012fa70, unsigned int 8, nsEventStatus & nsEventStatus_eIgnore) line 808 nsView::HandleEvent(nsView * const 0x013e8b00, nsGUIEvent * 0x0012fa70, unsigned int 8, nsEventStatus & nsEventStatus_eIgnore) line 808 nsScrollingView::HandleEvent(nsScrollingView * const 0x013e8b00, nsGUIEvent * 0x0012fa70, unsigned int 8, nsEventStatus & nsEventStatus_eIgnore) line 875 nsView::HandleEvent(nsView * const 0x013ce3a0, nsGUIEvent * 0x0012fa70, unsigned int 28, nsEventStatus & nsEventStatus_eIgnore) line 808 nsViewManager::DispatchEvent(nsViewManager * const 0x013cec70, nsGUIEvent * 0x0012fa70, nsEventStatus & nsEventStatus_eIgnore) line 1709 HandleEvent(nsGUIEvent * 0x0012fa70) line 64 nsWindow::DispatchEvent(nsWindow * const 0x013e8cb0, nsGUIEvent * 0x0012fa70, nsEventStatus & nsEventStatus_eIgnore) line 399 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fa70) line 415 nsWindow::OnKey(unsigned int 133, unsigned int 89, unsigned int 1, unsigned int 21) line 1362 + 24 bytes nsWindow::ProcessMessage(unsigned int 256, unsigned int 89, long 1376257, long * 0x0012fe60) line 1774 + 55 bytes nsWindow::WindowProc(void * 0x01430390, unsigned int 256, unsigned int 89, long 1376257) line 458 + 27 bytes USER32! 77e71250()

Moving to M4 We would like to fix this one ASAP, but not a show stopper for M3

This is very closely related to 3910. When I fix 3910, the fix for this will be iincluded. I am not marking this bug a duplicate though because the symptoms are so different. If 3910 is approved for M3, the fix for this will be in M3 also.

I believe this was fixed in M3, at the same time as 3910. This was a slightly different symptom of the same basic problem.

verified in 3/24 builds.