In editor mode, hitting enter twice in a row gives a crash: IsEmptyLine(nsIPresContext & {...}, nsLineBox * 0x012e4b80) line 3714 + 13 bytes nsBlockFrame::MarkEmptyLines(nsIPresContext & {...}) line 3796 + 13 bytes nsBlockFrame::DoRemoveFrame(nsIPresContext & {...}, nsIFrame * 0x00000000) line 3704 nsBlockFrame::RemoveFrame(nsBlockFrame * const 0x012e4c70, nsIPresContext & {...}, nsIPresShell & {...}, nsIAtom * 0x00000000, nsIFrame * 0x0123d670) line 3545 + 16 bytes nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x012b0320, nsIPresContext * 0x01268a30, nsIContent * 0x012d223c, nsIContent * 0x0123d25c, int 0) line 3551 + 31 bytes StyleSetImpl::ContentRemoved(StyleSetImpl * const 0x012b0290, nsIPresContext * 0x01268a30, nsIContent * 0x012d223c, nsIContent * 0x0123d25c, int 0) line 767 PresShell::ContentRemoved(PresShell * const 0x012b1128, nsIDocument * 0x01261270, nsIContent * 0x012d223c, nsIContent * 0x0123d25c, int 0) line 1628 + 37 bytes nsDocument::ContentRemoved(nsDocument * const 0x01261270, nsIContent * 0x012d223c, nsIContent * 0x0123d25c, int 0) line 1299 nsHTMLDocument::ContentRemoved(nsHTMLDocument * const 0x01261270, nsIContent * 0x012d223c, nsIContent * 0x0123d25c, int 0) line 737 nsGenericHTMLContainerElement::RemoveChildAt(int 0, int 1) line 2582 nsGenericHTMLContainerElement::RemoveChild(nsIDOMNode * 0x0123d250, nsIDOMNode * * 0x0012f7c0) line 2392 + 14 bytes nsHTMLHeadingElement::RemoveChild(nsHTMLHeadingElement * const 0x012d2230, nsIDOMNode * 0x0123d250, nsIDOMNode * * 0x0012f7c0) line 46 + 22 bytes nsEditor::SplitNodeImpl(nsEditor * const 0x013055e4, nsIDOMNode * 0x012d2230, int 1, nsIDOMNode * 0x013026c0, nsIDOMNode * 0x012cd720) line 1515 + 45 bytes SplitElementTxn::Do(SplitElementTxn * const 0x013024b0) line 62 + 66 bytes nsTransactionItem::Do() line 98 + 18 bytes nsTransactionManager::BeginTransaction(nsITransaction * 0x013024b0) line 552 + 11 bytes nsTransactionManager::Do(nsITransaction * 0x013024b0) line 92 + 15 bytes nsEditor::Do(nsEditor * const 0x013055e0, nsITransaction * 0x013024b0) line 596 + 29 bytes nsEditor::SplitNode(nsEditor * const 0x013055e0, nsIDOMNode * 0x012d2230, int 1, nsIDOMNode * * 0x0012f8f4) line 1412 + 16 bytes nsEditor::DeleteSelectionAndCreateNode(nsEditor * const 0x013055e0, const nsString & {...}, nsIDOMNode * * 0x0012f980) line 1057 + 49 bytes nsTextEditor::InsertBreak(nsTextEditor * const 0x013055e0, int 0) line 370 nsHTMLEditor::InsertBreak(nsHTMLEditor * const 0x013055e0, int 0) line 103 nsTextEditorKeyListener::KeyDown(nsIDOMEvent * 0x01302430) line 151 nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent * 0x0012fdb4, nsIDOMEvent * * 0x0012fae8, nsEventStatus & nsEventStatus_eIgnore) line 379 + 17 bytes nsDocument::HandleDOMEvent(nsDocument * const 0x01261270, nsIPresContext & {...}, nsEvent * 0x0012fdb4, nsIDOMEvent * * 0x0012fae8, unsigned int 1, nsEventStatus & nsEventStatus_eIgnore) line 1743 nsHTMLHtmlElement::HandleDOMEvent(nsHTMLHtmlElement * const 0x0126827c, nsIPresContext & {...}, nsEvent * 0x0012fdb4, nsIDOMEvent * * 0x00000000, unsigned int 1, nsEventStatus & nsEventStatus_eIgnore) line 173 + 41 bytes PresShell::HandleEvent(PresShell * const 0x012b1124, nsIView * 0x012d0660, nsGUIEvent * 0x0012fdb4, nsEventStatus & nsEventStatus_eIgnore) line 1917 + 34 bytes

Changed to M3 milestone

fixed.

Akkana, to regress this one, I simply install latest apprunner and load up the Editor Testbed right???

You can either use apprunner with the editor testbed (apprunner -editor), or viewer in tools->editor mode; whichever way is easiest, then try hitting return twice in a row.

verified in 3/16 build.