The problems in the testcase are, `nsIFrame::PeekOffsetForLine` returns a frame
for any content node outside the editing host and `nsIFrame::GetLastLeaf`
returns a native anonymous subtree node if the frame is for the native
anonymous subtree root like `<input>` or `<textarea>`.
For fixing the former, the methods need to check whether found frame's editable
state **and** whether the editable node is an inclusive descendant of the
editing host. However, there are complicated cases with inline editing hosts
and elements whose `contenteditable` is set to `false` and this is a new
regression for ESR 128. Therefore, we need to fix this without any behavior
changes as far as possible. Therefore, this patch basically checks only whether
the editing state of found one is editable and/or whether the one is an
inclusive descendant of the editing host to avoid `Selection` moves outside the
editing host. The reaming complicated cases should be handled in new bugs which
blocks bug 1873155.
For fixing the latter, `nsIFrame::GetLastLeaf` needs to check the given frame's
content is a native anonymous subtree root or not.
Differential Revision: https://phabricator.services.mozilla.com/D216371
