We hit an assertion in the content subtree iterator code if I do Edit->Select All, and then type a character. Here's the stack trace of the assertion: NTDLL! 77f76148() nsDebug::Assertion(char * 0x01bf918c, char * 0x01bf9188, char * 0x01bf9154, int 879) line 150 + 13 bytes nsContentSubtreeIterator::Init(nsContentSubtreeIterator * const 0x010f8ad0, nsIDOMRange * 0x01202e30) line 879 + 35 bytes nsRangeList::selectFrames(nsRangeList * const 0x0110f960, nsIDOMRange * 0x01202e30, int 0) line 1070 nsRangeList::Clear() line 783 + 23 bytes nsRangeList::Collapse(nsRangeList * const 0x0110f964, nsIDOMNode * 0x01116520, int 1) line 1437 CreateElementTxn::Do(CreateElementTxn * const 0x01018120) line 129 + 48 bytes nsTransactionItem::Do() line 102 + 18 bytes nsTransactionManager::BeginTransaction(nsITransaction * 0x01018120) line 1038 + 11 bytes nsTransactionManager::Do(nsTransactionManager * const 0x012057c0, nsITransaction * 0x01018120) line 134 + 18 bytes nsEditor::Do(nsEditor * const 0x01203c10, nsITransaction * 0x01018120) line 840 + 30 bytes nsEditor::CreateNode(nsEditor * const 0x01203c10, const nsString & {...}, nsIDOMNode * 0x01116520, int 1, nsIDOMNode * * 0x0012f664) line 1301 + 16 bytes nsEditor::InsertText(nsEditor * const 0x01203c10, const nsString & {...}) line 1505 + 58 bytes nsTextEditor::InsertText(nsTextEditor * const 0x01203c10, const nsString & {...}) line 1027 + 16 bytes nsHTMLEditor::InsertText(nsHTMLEditor * const 0x01203c10, const nsString & {...}) line 162 nsTextEditorKeyListener::KeyDown(nsIDOMEvent * 0x00f24780) line 248 + 22 bytes nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent * 0x0012fbd8, nsIDOMEvent * * 0x0012f944, unsigned int 3, nsEventStatus & nsEventStatus_eIgnore) line 733 + 17 bytes nsDocument::HandleDOMEvent(nsDocument * const 0x011f59f0, nsIPresContext & {...}, nsEvent * 0x0012fbd8, nsIDOMEvent * * 0x0012f944, unsigned int 1, nsEventStatus & nsEventStatus_eIgnore) line 2283 nsHTMLHtmlElement::HandleDOMEvent(nsHTMLHtmlElement * const 0x011f54bc, nsIPresContext & {...}, nsEvent * 0x0012fbd8, nsIDOMEvent * * 0x00000000, unsigned int 1, nsEventStatus & nsEventStatus_eIgnore) line 175 + 41 bytes PresShell::HandleEvent(PresShell * const 0x0110f894, nsIView * 0x01117600, nsGUIEvent * 0x0012fbd8, nsEventStatus & nsEventStatus_eIgnore) line 2018 + 39 bytes nsView::HandleEvent(nsView * const 0x01117600, nsGUIEvent * 0x0012fbd8, unsigned int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 833 nsView::HandleEvent(nsView * const 0x01116c00, nsGUIEvent * 0x0012fbd8, unsigned int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 818 nsView::HandleEvent(nsView * const 0x01116b30, nsGUIEvent * 0x0012fbd8, unsigned int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 818 nsView::HandleEvent(nsView * const 0x0110f480, nsGUIEvent * 0x0012fbd8, unsigned int 28, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 818 nsViewManager::DispatchEvent(nsViewManager * const 0x0110fe50, nsGUIEvent * 0x0012fbd8, nsEventStatus & nsEventStatus_eIgnore) line 1741 HandleEvent(nsGUIEvent * 0x0012fbd8) line 67 nsWindow::DispatchEvent(nsWindow * const 0x01116cd4, nsGUIEvent * 0x0012fbd8, nsEventStatus & nsEventStatus_eIgnore) line 417 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fbd8) line 438 nsWindow::DispatchKeyEvent(unsigned int 133, unsigned short 97, unsigned int 97) line 1835 + 15 bytes nsWindow::OnChar(unsigned int 97) line 2146 nsWindow::ProcessMessage(unsigned int 258, unsigned int 97, long 1966081, long * 0x0012fdb8) line 2328 + 15 bytes nsWindow::WindowProc(void * 0x00b4061a, unsigned int 258, unsigned int 97, long 1966081) line 480 + 27 bytes USER32! 77e71250()

Darn, and I was doing so well at deflecting M7 bugs. This one is real, and mine. Setting to M7.

-> M8. Come back if you find something in the next day or so.

fixed

verified in 7/8 build.