open any document that contains text make some of it bold make some if the bold text not bold crash stack: nsDebug::PreCondition(char * 0x0070abec, char * 0x0070ac28, char * 0x0070ac38, int 383) line 120 + 13 bytes nsCOMPtr<nsIContent>::operator->() line 383 + 34 bytes nsContentIterator::NextNode(nsCOMPtr<nsIContent> * 0x0173c688) line 458 + 21 bytes nsContentIterator::Next(nsContentIterator * const 0x0173c680) line 565 nsRangeList::selectFrames(nsRangeList * const 0x017b1980, nsIDOMRange * 0x0173c360, int 1) line 817 nsRangeList::Collapse(nsRangeList * const 0x017b1984, nsIDOMNode * 0x01732d00, int 2) line 1194 SplitElementTxn::Do(SplitElementTxn * const 0x01732c80) line 83 + 42 bytes nsTransactionItem::Do() line 102 + 18 bytes nsTransactionManager::BeginTransaction(nsITransaction * 0x01732c80) line 560 + 11 bytes nsTransactionManager::Do(nsITransaction * 0x01732c80) line 98 + 15 bytes nsEditor::Do(nsEditor * const 0x017c9d50, nsITransaction * 0x01732c80) line 764 + 29 bytes nsEditor::SplitNode(nsEditor * const 0x017c9d50, nsIDOMNode * 0x0171e450, int 2, nsIDOMNode * * 0x0012f19c) line 1825 + 16 bytes nsTextEditor::RemoveTextPropertiesForNode(nsTextEditor * const 0x017c9d50, nsIDOMNode * 0x0171e4c0, nsIDOMNode * 0x0171e450, int 1, int 6, nsIAtom * 0x017c9e80, const nsString * 0x00000000) line 1868 + 58 bytes nsTextEditor::RemoveTextProperty(nsTextEditor * const 0x017c9d70, nsIAtom * 0x017c9e80, const nsString * 0x00000000) line 677 + 51 bytes nsHTMLEditor::RemoveTextProperty(nsHTMLEditor * const 0x017c9d70, nsIAtom * 0x017c9e80, const nsString * 0x00000000) line 143 nsTextEditorKeyListener::ProcessShortCutKeys(nsIDOMEvent * 0x01727740, int & 1) line 396 nsTextEditorKeyListener::KeyDown(nsIDOMEvent * 0x01727740) line 168 nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent * 0x0012fd58, nsIDOMEvent * * 0x0012fac8, unsigned int 3, nsEventStatus & nsEventStatus_eIgnore) line 667 + 17 bytes

set priority, severity, and milestone. added mike to the cc list on the unlikely chance that his selection changes are involved.

accepting bugs

I have been unable to reproduce this. I believe this is the bug that Mike fixed where by not passing bad info to the iterator. I still need to make the iterator not misbehavew in the face fo bad input, but that can wait for M6. I'll open a new bug on that and close this one.

I can't reproduce this also...but I found another problem in that we can't remove an attribute. filing a separate bug on this.