ASSERTION FAILED: containerA && containerB
It looks like comparePoint specifically deals with the possibility that a range is detached and it's m_start.container is null. However, compareBoundaryPoints asserts that both are non-null, but returns different (-1 vs 1) if one of them is NULL. Maybe the ASSERT is just invalid?
var ra = document.createRange();
Created attachment 21671 [details]
test case (will assert)
Confirmed with r34513.
Created attachment 27700 [details]
I think that the ASSERT is correct - it's the release-only code below it that's probably unneeded, but was added for extra safety.
Comment on attachment 27700 [details]
Does this behavior match something in some specification, or is this a gray area?
These methods are Firefox extensions, without much documentation.
Committed revision 41253.