Make `AutoMoveOneLineHandler` track the new line range while moving content nodes
It moves nodes in a range to new place one by one. At this time, the moved
position range is not tracked. Therefore, if the DOM tree is unexpectedly
changed by `HTMLEditor` itself, the range gets broken. E.g., in this case,
deleting empty inline element causes the range after the source position is
broken.
Differential Revision: https://phabricator.services.mozilla.com/D192180
bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1858794
gecko-commit: a7200c4d402a2ac9407512a17978f59356d94470
gecko-reviewers: m_kato
diff --git a/editing/crashtests/delete-at-text-following-svg.html b/editing/crashtests/delete-at-text-following-svg.html
new file mode 100644
index 0000000..cc2040a
--- /dev/null
+++ b/editing/crashtests/delete-at-text-following-svg.html
@@ -0,0 +1,41 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<style>
+mask, li {
+ float: inline-start;
+ animation-name: kf0;
+}
+@keyframes kf0 {}
+</style>
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+ window.focus();
+ document.designMode = "on";
+ document.onpointerlockerror = onPointerLockErrorOrAnimationStart;
+ const mask = document.querySelector("mask");
+ mask.requestPointerLock();
+ mask.prepend(document.querySelector("table"));
+});
+function onPointerLockErrorOrAnimationStart() {
+ document.execCommand("underline");
+ document.execCommand("delete");
+ onanimationstart = onPointerLockErrorOrAnimationStart;
+ try {
+ getSelection().setBaseAndExtent(
+ document.querySelector("li"), 0,
+ document.querySelector("thead"), 0
+ );
+ } catch (e) {}
+}
+</script>
+<body><svg>
+<mask>
+<clipPath>
+</clipPath></mask></svg><sup>
+AA
+<li>
+<br></li></sup><table>
+<thead>
+</thead></table>
