Make AutoMoveOneLineHandler track the new line range while moving c…

…ontent nodes It moves nodes in a range to new place one by one. At this time, the moved position range is not tracked. Therefore, if the DOM tree is unexpectedly changed by `HTMLEditor` itself, the range gets broken. E.g., in this case, deleting empty inline element causes the range after the source position is broken. Differential Revision: https://phabricator.services.mozilla.com/D192180 bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1858794 gecko-commit: a7200c4d402a2ac9407512a17978f59356d94470 gecko-reviewers: m_kato
Lightning00Blade · May 2, 2024 · 1480047 · 1480047
1 parent 89ba8fc
commit 1480047
Showing 1 changed file with 41 additions and 0 deletions.
diff --git a/editing/crashtests/delete-at-text-following-svg.html b/editing/crashtests/delete-at-text-following-svg.html
@@ -0,0 +1,41 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<style>
+mask, li {
+  float: inline-start;
+  animation-name: kf0;
+}
+@keyframes kf0 {}
+</style>
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  window.focus();
+  document.designMode = "on";
+  document.onpointerlockerror = onPointerLockErrorOrAnimationStart;
+  const mask = document.querySelector("mask");
+  mask.requestPointerLock();
+  mask.prepend(document.querySelector("table"));
+});
+function onPointerLockErrorOrAnimationStart() {
+  document.execCommand("underline");
+  document.execCommand("delete");
+  onanimationstart  = onPointerLockErrorOrAnimationStart;
+  try {
+    getSelection().setBaseAndExtent(
+      document.querySelector("li"), 0,
+      document.querySelector("thead"), 0
+    );
+  } catch (e) {}
+}
+</script>
+<body><svg>
+<mask>
+<clipPath>
+</clipPath></mask></svg><sup>
+AA
+<li>
+<br></li></sup><table>
+<thead>
+</thead></table>