Make SetContentEditable update element state right when it changes.
Instead of at a later point. This prevents stuff getting out of sync during that
time, which can cause assertions to fire.
Differential Revision: https://phabricator.services.mozilla.com/D68978
bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1625369
gecko-commit: b33280bc324fac62aa278889aae8b60e507c566d
gecko-integration-branch: autoland
gecko-reviewers: smaug
diff --git a/editing/other/design-mode-textarea-crash.html b/editing/other/design-mode-textarea-crash.html
new file mode 100644
index 0000000..d9f01e4
--- /dev/null
+++ b/editing/other/design-mode-textarea-crash.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<script>
+onload = function() {
+ let x2 = document.getElementById("x2");
+ x2.select();
+ x2.placeholder = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+ document.designMode = "on";
+}
+</script>
+<textarea id="x2" inputmode="text" spellcheck="false" rows="32" readonly="">
+<data id="x56" part="part1" accesskey="" translate="no">
+Baa1101 11
+</data>
+</textarea>
