Pull/build from April 8, 1999. Solaris 2.6, Purify, gcc 2.7.2.3. Launch apprunner, pull up editor. I inserted a link, undid the link insertion and then re-did the link insertion and got a coredump. **** Purify instrumented ./apprunner.pure (pid 16118) **** COR: Fatal core dump: * This is occurring while in: _p921static [crtn.o] _resetsig [sig.c] _sigon [libthread.so.1] _thrp_kill [thread.c] abort [libc.so.1] PR_Abort [prlog.c:461] nsDebug::Abort(const char*,int) [nsDebug.cpp:93] nsDebug::Break(const char*,int) [nsDebug.cpp:108] nsDebug::Assertion(const char*,const char*,const char*,int) [nsDebug.cpp:140] DeleteTextTxn::Do() [DeleteTextTxn.cpp:65] EditTxn::Redo() [EditTxn.cpp:52] EditAggregateTxn::Redo() [EditAggregateTxn.cpp:93] DeleteRangeTxn::Redo() [DeleteRangeTxn.cpp:186] EditAggregateTxn::Redo() [EditAggregateTxn.cpp:93] EditAggregateTxn::Redo() [EditAggregateTxn.cpp:93] nsTransactionItem::Redo() [nsTransactionItem.cpp:207] nsTransactionItem::RedoChildren() [nsTransactionItem.cpp:253] nsTransactionItem::Redo() [nsTransactionItem.cpp:213] nsTransactionItem::RedoChildren() [nsTransactionItem.cpp:253] nsTransactionItem::Redo() [nsTransactionItem.cpp:213] nsTransactionManager::Redo() [nsTransactionManager.cpp:196] nsEditor::Redo(unsigned int) [nsEditor.cpp:745] nsTextEditor::Redo(unsigned int) [nsTextEditor.cpp:750] nsHTMLEditor::Redo(unsigned int) [nsHTMLEditor.cpp:234] nsEditorAppCore::Redo() [nsEditorAppCore.cpp:740] EditorAppCoreRedo(JSContext*,JSObject*,unsigned int,long*,long*) [nsJSEditorAppCore.cpp:371] js_Invoke [jsinterp.c:650] js_Interpret [jsinterp.c:2183] js_Invoke [jsinterp.c:666] js_Interpret [jsinterp.c:2183] * Received signal 6 (SIGABRT - Abort) * Signal mask: * Pending signals:

Marking M5. Might be related to the use of copy/paste to save the contents under the link; I wanted to rewrite that to use a document fragment anyway.

I haven't been looking at this bug because insert link has been rewritten to bring up a dialog and then to use buster's new insert element code, but bringing up dialogs crashes on unix (bug 5534). I suspect that this bug is fixed, but until dialogs are working I can't verify that. Sorry, postponing this one to M6 (but it might well already be fixed if we could only get that far).

Charley's fix did fix this problem -- yay! I see a lot of gtk warnings, but I don't see an assertion and the undo/redo works correctly.

verified in 5/14 build...

*** Bug 76756 has been marked as a duplicate of this bug. ***