https://searchfox.org/mozilla-central/rev/43ba67391e71c57a14420e554e9d381543292611/layout/generic/nsIFrame.cpp#8864 and other peek* methods don't seem to check if there is NAC around so selection's range may have boundary points pointing to native anonymous content. But maybe I'm missing something.

This bug is somewhere between selection and layout.

emilio, jfkthame, perhaps you have ideas how to handle this

Possibly useful stack. The range gets <select> as the root and its NAC text node as start and end container.

#10 0x00007f206186c363 in nsRange::DoSetRange<nsINode*, nsIContent*, nsINode*, nsIContent*>(mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&, mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&, nsINode*, bool)
(this=0x7f2052d12580, aStartBoundary=..., aEndBoundary=..., aRootNode=0x7f203e909040, aNotInsertedYet=false) at /home/smaug/mozilla/hg/shistory/dom/base/nsRange.cpp:978
#11 0x00007f206148fad6 in mozilla::dom::AbstractRange::SetStartAndEndInternal<nsINode*, nsIContent*, nsINode*, nsIContent*, nsRange>(mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&, mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&, nsRange*) (aStartBoundary=..., aEndBoundary=..., aRange=0x7f2052d12580) at /home/smaug/mozilla/hg/shistory/dom/base/AbstractRange.cpp:169
#12 0x00007f20617188a5 in nsRange::SetStartAndEnd<nsINode*, nsIContent*, nsINode*, nsIContent*>(mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&, mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&)
(this=0x7f2052d12580, aStartBoundary=..., aEndBoundary=...) at /home/smaug/mozilla/hg/shistory/dom/base/nsRange.h:163
#13 0x00007f206170e5b1 in nsRange::CollapseTo(mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&) (this=0x7f2052d12580, aPoint=...) at /home/smaug/mozilla/hg/shistory/dom/base/nsRange.h:187
#14 0x00007f20616f6b30 in mozilla::dom::Selection::CollapseInternal(mozilla::dom::Selection::InLimiter, mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&, mozilla::ErrorResult&)
(this=0x7f204061ab80, aInLimiter=mozilla::dom::Selection::InLimiter::eYes, aPoint=..., aRv=...) at /home/smaug/mozilla/hg/shistory/dom/base/Selection.cpp:2201
#15 0x00007f2061718ad7 in mozilla::dom::Selection::CollapseInLimiter(mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&, mozilla::ErrorResult&) (this=0x7f204061ab80, aPoint=..., aRv=...)
at /home/smaug/mozilla/hg/shistory/ff_build/dist/include/mozilla/dom/Selection.h:223
#16 0x00007f2061718a69 in mozilla::dom::Selection::CollapseInLimiter(mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&) (this=0x7f204061ab80, aPoint=...)
at /home/smaug/mozilla/hg/shistory/ff_build/dist/include/mozilla/dom/Selection.h:218
#17 0x00007f206170f44c in mozilla::dom::Selection::CollapseInLimiter(nsINode*, unsigned int) (this=0x7f204061ab80, aContainer=0x7f203e905580, aOffset=0) at /home/smaug/mozilla/hg/shistory/ff_build/dist/include/mozilla/dom/Selection.h:213
#18 0x00007f206630faf3 in nsFrameSelection::TakeFocus(nsIContent&, unsigned int, unsigned int, mozilla::CaretAssociationHint, nsFrameSelection::FocusMode)
(this=0x7f20442f2b00, aNewFocus=..., aContentOffset=0, aContentEndOffset=0, aHint=mozilla::CARET_ASSOCIATE_AFTER, aFocusMode=nsFrameSelection::FocusMode::kCollapseToNewPoint) at /home/smaug/mozilla/hg/shistory/layout/generic/nsFrameSelection.cpp:1413
#19 0x00007f206630e6dc in nsFrameSelection::MoveCaret(nsDirection, bool, nsSelectionAmount, nsFrameSelection::CaretMovementStyle)
(this=0x7f20442f2b00, aDirection=eDirPrevious, aContinueSelection=false, aAmount=eSelectLine, aMovementStyle=nsFrameSelection::eVisual) at /home/smaug/mozilla/hg/shistory/layout/generic/nsFrameSelection.cpp:855
#20 0x00007f20616fbbfe in mozilla::dom::Selection::Modify(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)
(this=0x7f204061ab80, aAlter=..., aDirection=..., aGranularity=..., aRv=...) at /home/smaug/mozilla/hg/shistory/dom/base/Selection.cpp:3407