Go to http://www.mozilla.org/editor/midasdemo/.
1. Click on the "View HTML Source" checkbox
2. Type in "<blockquote>foo</blockquote>"
3. Uncheck the view html source checkbox.
4. Place your cursor in or after the word foo.
5. Hit ctrl+z once or twice.
Crashes every time. I tried coming up with something more reduced, but couldn't.
Created attachment 22526 [details]
In a debug build of TOT, this hits an assert
ASSERTION FAILED: m_refChild->parentNode()
(...WebCore/editing/InsertNodeBeforeCommand.cpp:59 virtual void WebCore::InsertNodeBeforeCommand::doUnapply())
*** Bug 20676 has been marked as a duplicate of this bug. ***
Created attachment 26218 [details]
Comment on attachment 26218 [details]
1) my eyes have gone partly numb reviewing this patch, so I'm not 100% confident that I would have noticed minor errors
2) it's not obvious from these changes whether the various vaguely-specified bug reports have actually been fixed
But still, I didn't see any actual problems, and I saw lots of robustification. r=me assuming it passes the current layout tests.
OK. I believe that fixes the bug. Now we need some more testing to see if the crash is truly gone and also to see if all those duplicates were really duplicates.