This bug occurs that WSRunObject::PrepareToDeleteRangePriv() calls WSRunObject::ConvertToNBSP for non-editable text node.
Actually, even if text node isn't editable, WSFragment::mType becomes WSType::text now. So, whitespace only node at the end of contenteditable=false is treated as WSType::normalWS, i.e., treated as editable.
So text node in contenteditable=false should treated as WSType::special which means a non-editable inline object. Then, WSRunObject won't create object chunk of WSType::normalWS for text node in contenteditable=false.
MozReview-Commit-ID: GOjxax8KvDD
--HG--
extra : rebase_source : e5fff30a2710c2021d59ce88bf2698ce4ebe2dfc
Makoto Kato