Fix crash in moveBefore

This crash was created because when we move inputs around some of their (shadow) descendants are text fragments, and FlatTreeParentChanged doesn't like that. Made it so that FlatTreeParentChanged only works on elements/text nodes. Bug: 352081025 Change-Id: Ied34f1e66817fde8625b56dbbf2ed05e62eb68bd Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5691651 Reviewed-by: Dominic Farolino <dom@chromium.org> Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> Cr-Commit-Position: refs/heads/main@{#1325460}
web-platform-tests · Jul 18, 2024 · 7029cb1 · 7029cb1
1 parent c34a15c
commit 7029cb1
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/dom/nodes/moveBefore/tentative/input-moveBefore-crash.html b/dom/nodes/moveBefore/tentative/input-moveBefore-crash.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<body>
+<input id="input">
+<script>
+window.onload = () => {
+    document.body.moveBefore(document.querySelector("#input"), null);
+};
+</script>