This is a simple bug of internal API of HTMLEditor. HTMLEditor::GetBlock() tries to retrieve nearest ancestor block node (including itself) of a node. HTMLEditor::GetBlock() may have ancestor limiter typically it's active editing host to prevent to modify editing host or its ancestor accidentally. However, it forgets to call HTMLEditor::GetBlockNodeParent() with the given ancestor limit node. Therefore, if editing host is an inline element and its parent is a block element, the editing host is split accidentally. MozReview-Commit-ID: Ermmxdnk4KB