Bug 1658534 - part 2: Avoid infinite recursive calls at removing an invisible `<br>` element r=m_kato

Differential Revision: https://phabricator.services.mozilla.com/D86910

editor/libeditor/HTMLEditSubActionHandler.cpp

@@ -2569,12 +2569,39 @@ EditActionResult HTMLEditor::HandleDeleteSelectionInternal(
             NS_WARNING("HTMLEditor::DeleteNodeWithTransaction() failed");
             return EditActionResult(rv);
           }
-          if (!SelectionRefPtr()->RangeCount()) {
-            return EditActionHandled();
+          if (SelectionRefPtr()->RangeCount() != 1) {
+            NS_WARNING(
+                "Selection was unexpected after removing an invisible `<br>` "
+                "element");
+            return EditActionHandled(NS_ERROR_EDITOR_UNEXPECTED_DOM_TREE);
           }
-          // XXX This nesting call is not safe.  If mutation event listener
-          //     creates same situation, this causes stack-overflow.
           AutoRangeArray rangesToDelete(*SelectionRefPtr());
+          caretPoint = aRangesToDelete.GetStartPointOfFirstRange();
+          if (!caretPoint.IsSet()) {
+            NS_WARNING(
+                "New selection after deleting invisible `<br>` element was "
+                "invalid");
+            return EditActionHandled(NS_ERROR_FAILURE);
+          }
+          if (MaybeHasMutationEventListeners(
+                  NS_EVENT_BITS_MUTATION_SUBTREEMODIFIED |
+                  NS_EVENT_BITS_MUTATION_NODEREMOVED |
+                  NS_EVENT_BITS_MUTATION_NODEREMOVEDFROMDOCUMENT)) {
+            // Let's check whether there is new invisible `<br>` element
+            // for avoiding infinit recursive calls.
+            WSRunScanner wsRunScannerAtCaret(*this, caretPoint);
+            WSScanResult scanFromCaretPointResult =
+                aDirectionAndAmount == nsIEditor::eNext
+                    ? wsRunScannerAtCaret
+                          .ScanNextVisibleNodeOrBlockBoundaryFrom(caretPoint)
+                    : wsRunScannerAtCaret
+                          .ScanPreviousVisibleNodeOrBlockBoundaryFrom(
+                              caretPoint);
+            if (scanFromCaretPointResult.ReachedBRElement() &&
+                !IsVisibleBRElement(scanFromCaretPointResult.BRElementPtr())) {
+              return EditActionHandled(NS_ERROR_EDITOR_UNEXPECTED_DOM_TREE);
+            }
+          }
           EditActionResult result = HandleDeleteSelectionInternal(
               aDirectionAndAmount, aStripWrappers, rangesToDelete);
           NS_WARNING_ASSERTION(