Bug 1420415 - TextEditor::CreateBRImpl() needs to make pointToInsertBrNode store mOffset before calling EditorBase::CreateNode() r?m_kato When TextEditor::CreateBRImpl() splits a text node before inserting new <br> element, it initializes pointToInsertBrNode only with the right text node. Then, it refers its Offset() after inserting new <br> node before the point. Therefore, the offset is computed with the new DOM tree. So, adding 1 to the offset is redundant only in this case. So, before calling CreateNode(), it needs to make pointToInsertBrNode store offset with calling its Offset(). Note that this ugly code will be replaced with patches for bug 1408227. Additionally, this doesn't use AutoEditorDOMPointChildInvalidator because it's not available in 58 but we need to uplift this patch. Finally, I'm not sure how to check this in automated tests. Therefore, this patch doesn't include automated tests. MozReview-Commit-ID: IaQBonoGawR

--- a/editor/libeditor/TextEditor.cpp
+++ b/editor/libeditor/TextEditor.cpp
@@ -461,16 +461,19 @@ TextEditor::CreateBRImpl(nsCOMPtr<nsIDOM
       nsCOMPtr<nsIContent> newLeftNode = SplitNode(atStartOfNewLine, error);
       if (NS_WARN_IF(error.Failed())) {
         return error.StealNSResult();
       }
       // The right node offset in the parent is now changed.  Recompute it.
       pointToInsertBrNode.Set(node);
       Unused << newLeftNode;
     }
+    // Lock the offset of pointToInsertBrNode because it'll be referred after
+    // inserting a new <br> node before it.
+    Unused << pointToInsertBrNode.Offset();
     // create br
     brNode = CreateNode(nsGkAtoms::br, pointToInsertBrNode);
     if (NS_WARN_IF(!brNode)) {
       return NS_ERROR_FAILURE;
     }
     *aInOutParent = GetAsDOMNode(pointToInsertBrNode.Container());
     *aInOutOffset = pointToInsertBrNode.Offset() + 1;
   } else {