diff --git a/dom/base/CrossShadowBoundaryRange.cpp b/dom/base/CrossShadowBoundaryRange.cpp
index 52ff718fba81..c73bf78537d2 100644
--- a/dom/base/CrossShadowBoundaryRange.cpp
+++ b/dom/base/CrossShadowBoundaryRange.cpp
@@ -243,4 +243,13 @@ void CrossShadowBoundaryRange::CharacterDataChanged(
mOwner);
}
}
+
+// DOM mutation for shadow-crossing selection is not specified.
+// Spec issue: https://github.com/w3c/selection-api/issues/168
+void CrossShadowBoundaryRange::ParentChainChanged(nsIContent* aContent) {
+ MOZ_ASSERT(mCommonAncestor == aContent,
+ "Wrong ParentChainChanged notification");
+ MOZ_ASSERT(mOwner);
+ mOwner->ResetCrossShadowBoundaryRange();
+}
} // namespace mozilla::dom
diff --git a/dom/base/CrossShadowBoundaryRange.h b/dom/base/CrossShadowBoundaryRange.h
index 8808b5dc1f63..cb6e694ac8ee 100644
--- a/dom/base/CrossShadowBoundaryRange.h
+++ b/dom/base/CrossShadowBoundaryRange.h
@@ -58,6 +58,7 @@ class CrossShadowBoundaryRange final : public StaticRange,
NS_DECL_NSIMUTATIONOBSERVER_CHARACTERDATACHANGED
NS_DECL_NSIMUTATIONOBSERVER_CONTENTREMOVED
+ NS_DECL_NSIMUTATIONOBSERVER_PARENTCHAINCHANGED
private:
explicit CrossShadowBoundaryRange(nsINode* aNode, nsRange* aOwner)
diff --git a/dom/base/crashtests/1907464.html b/dom/base/crashtests/1907464.html
new file mode 100644
index 000000000000..8e0bbe16c70a
--- /dev/null
+++ b/dom/base/crashtests/1907464.html
@@ -0,0 +1,12 @@
+
+
+
+a
diff --git a/dom/base/crashtests/crashtests.list b/dom/base/crashtests/crashtests.list
index 5d1342ddb7ed..b9fd5ab8ff8b 100644
--- a/dom/base/crashtests/crashtests.list
+++ b/dom/base/crashtests/crashtests.list
@@ -280,3 +280,4 @@ load 1890888.html
load 1890899.html
load 1896225.html
load 1897248.html
+load 1907464.html