using the 3/23 build of apprunner: 1) launch the apprunner -editor 2) Click on the Insert sTuff button about 1-2 times. Crash. Gtk-CRITICAL **: file gtkbox.c: line 332 (gtk_box_pack_start): assertion `child->parent == NULL' failed. Inserting text Segmentation fault (core dumped)

Yup, just as described. Here's the stack trace. Maybe the caret is getting confused by whatever InsertStuff is doing? Is this only Linux, or does it happen on other platforms? #0 0x4046bd67 in TextFrame::GetWidth (this=0x823e340, aRenderingContext=@0x823e3a0, aTextStyle=@0xbffff3bc, aBuffer=0xc0000000, aLength=136564554, aWidthResult=@0xbfffdb78) at /builds/tue/mozilla/layout/html/base/src/nsTextFrame.cpp:1204 #1 0x4046e48f in TextFrame::GetPointFromOffset (this=0x823e340, inPresContext=0x81ed5d0, inRendContext=0x823e3a0, inOffset=41, outPoint=0xbffff4e4) at /builds/tue/mozilla/layout/html/base/src/nsTextFrame.cpp:1878 #2 0x403fb7a7 in nsCaret::DrawCaret (this=0x8209420) at /builds/tue/mozilla/layout/base/src/nsCaret.cpp:336 #3 0x403fb94d in nsCaret::CaretBlinkCallback (aTimer=0x8249c80, aClosure=0x8209420) at /builds/tue/mozilla/layout/base/src/nsCaret.cpp:376

it happens only on Linux.

The problem probably exists XP, but it only crashes on Linux because text measurement on that platform objects to being given bogus offsets. This is my bug.

*** Bug 4211 has been marked as a duplicate of this bug. ***

This is probably fixed by Mike's fixes for selection in PRE text. Sujay, can you re-test?

M4

Again, the same fix as 4153. Note that the Insert Text function is now available from the debug menu in the editor window.

Oh wait, I lied. This crash is/was different. But I think it has already been fixed by other changes. QA: when testing this, please test in both preformatted text and normal text.

verified in 4/5 build. works fine now...