Make HTMLEditor::SplitAncestorStyledInlineElementsAtRangeEdges abor…

…t if splitting points are lost Due to the `DOMNodeRemoved` event listener, splitting at range boundaries may fail tracking the DOM tree due to unexpected container lost. In the cases, the method should abort its task. Differential Revision: https://phabricator.services.mozilla.com/D184457 bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1845208 gecko-commit: c8b0f9251387925f0a9e26d5458af36114c0b736 gecko-reviewers: m_kato
web-platform-tests · Jul 31, 2023 · a565ad1 · a565ad1
1 parent 490feeb
commit a565ad1
Showing 1 changed file with 29 additions and 0 deletions.
diff --git a/editing/crashtests/removeformat-from-DOMNodeRemoved.html b/editing/crashtests/removeformat-from-DOMNodeRemoved.html
@@ -0,0 +1,29 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  window.find("a");
+  document.addEventListener("DOMNodeRemoved", () => {
+    try {
+      document.getElementById("target").normalize();
+      document.execCommand("removeFormat");
+    } catch (e) {
+    }
+  });
+  document.adoptNode(document.querySelector("datalist"));
+});
+</script>
+</head>
+<body>
+<kbd>
+<datalist>
+</kbd>
+<figcaption contenteditable>
+<font id="target">
+a
+</font>
+</figcaption>
+</body>
+</html>