Bug 1907464 - Clear the shadow-crossing selection when the ParentChainChanged notification is called on the common ancestor r=jjaschke,dom-core

It's unclear from the spec about where the new selection should be,
so we just clear the selection at the moment.

Differential Revision: https://phabricator.services.mozilla.com/D216572

dom/base/CrossShadowBoundaryRange.cpp

@@ -243,4 +243,13 @@ void CrossShadowBoundaryRange::CharacterDataChanged(
                mOwner);
   }
 }
+
+// DOM mutation for shadow-crossing selection is not specified.
+// Spec issue: https://github.com/w3c/selection-api/issues/168
+void CrossShadowBoundaryRange::ParentChainChanged(nsIContent* aContent) {
+  MOZ_ASSERT(mCommonAncestor == aContent,
+             "Wrong ParentChainChanged notification");
+  MOZ_ASSERT(mOwner);
+  mOwner->ResetCrossShadowBoundaryRange();
+}
 }  // namespace mozilla::dom

dom/base/CrossShadowBoundaryRange.h

@@ -58,6 +58,7 @@ class CrossShadowBoundaryRange final : public StaticRange,
 
   NS_DECL_NSIMUTATIONOBSERVER_CHARACTERDATACHANGED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTREMOVED
+  NS_DECL_NSIMUTATIONOBSERVER_PARENTCHAINCHANGED
 
  private:
   explicit CrossShadowBoundaryRange(nsINode* aNode, nsRange* aOwner)

dom/base/crashtests/1907464.html

@@ -0,0 +1,12 @@
+<script>
+window.addEventListener("DOMContentLoaded", () => {
+  let sel = document.getSelection()
+  sel.setPosition(a.offsetParent.attachShadow({mode: "open"}), 0)
+  sel.extend(b, 0)
+  c.replaceWith("1")
+  document.documentElement.innerHTML = document.documentElement.innerHTML
+})
+</script>
+<shadow id="a">
+<style id="b"></style>
+<font id="c">a</font>

dom/base/crashtests/crashtests.list

@@ -280,3 +280,4 @@ load 1890888.html
 load 1890899.html
 load 1896225.html
 load 1897248.html
+load 1907464.html