diff --git a/dom/base/CrossShadowBoundaryRange.cpp b/dom/base/CrossShadowBoundaryRange.cpp index 52ff718fba81..c73bf78537d2 100644 --- a/dom/base/CrossShadowBoundaryRange.cpp +++ b/dom/base/CrossShadowBoundaryRange.cpp @@ -243,4 +243,13 @@ void CrossShadowBoundaryRange::CharacterDataChanged( mOwner); } } + +// DOM mutation for shadow-crossing selection is not specified. +// Spec issue: https://github.com/w3c/selection-api/issues/168 +void CrossShadowBoundaryRange::ParentChainChanged(nsIContent* aContent) { + MOZ_ASSERT(mCommonAncestor == aContent, + "Wrong ParentChainChanged notification"); + MOZ_ASSERT(mOwner); + mOwner->ResetCrossShadowBoundaryRange(); +} } // namespace mozilla::dom diff --git a/dom/base/CrossShadowBoundaryRange.h b/dom/base/CrossShadowBoundaryRange.h index 8808b5dc1f63..cb6e694ac8ee 100644 --- a/dom/base/CrossShadowBoundaryRange.h +++ b/dom/base/CrossShadowBoundaryRange.h @@ -58,6 +58,7 @@ class CrossShadowBoundaryRange final : public StaticRange, NS_DECL_NSIMUTATIONOBSERVER_CHARACTERDATACHANGED NS_DECL_NSIMUTATIONOBSERVER_CONTENTREMOVED + NS_DECL_NSIMUTATIONOBSERVER_PARENTCHAINCHANGED private: explicit CrossShadowBoundaryRange(nsINode* aNode, nsRange* aOwner) diff --git a/dom/base/crashtests/1907464.html b/dom/base/crashtests/1907464.html new file mode 100644 index 000000000000..8e0bbe16c70a --- /dev/null +++ b/dom/base/crashtests/1907464.html @@ -0,0 +1,12 @@ + + + +a diff --git a/dom/base/crashtests/crashtests.list b/dom/base/crashtests/crashtests.list index 5d1342ddb7ed..b9fd5ab8ff8b 100644 --- a/dom/base/crashtests/crashtests.list +++ b/dom/base/crashtests/crashtests.list @@ -280,3 +280,4 @@ load 1890888.html load 1890899.html load 1896225.html load 1897248.html +load 1907464.html