IndexSizeError: Failed to execute 'splitText' on 'Text' during pasteHTML

Description

pasteHTML can throw an uncaught IndexSizeError instead of completing the paste:

Uncaught IndexSizeError: Failed to execute 'splitText' on 'Text': The offset X is larger than the Text node's length.

Stack trace pattern

at splitNode (dom.js)
at splitTree (dom.js)
at splitPoint (dom.js)
at insertNode (range.js)
at pasteHTML (range.js)
at pasteHTML (editor.js)

(function names are shortened in minified builds, e.g. lt/ct, but the call chain is the same)

Root cause

splitNode() in src/js/core/dom.js calls:

return point.node.splitText(point.offset);

point.offset is computed earlier (e.g. via an offset path built from the current selection/range) against the DOM as it exists at that time. If the browser normalizes, merges, or otherwise shortens that text node before splitNode actually runs — which can happen while pasting HTML — the previously computed offset can end up larger than the text node's current length, and Text.splitText() throws instead of returning a sensibly split result. This aborts the paste entirely for the user.

Suggested fix

Clamp the offset to the text node's current length before calling splitText, so a stale/out-of-range offset degrades to a right-edge split instead of throwing:

const offset = Math.min(point.offset, point.node.length);
return point.node.splitText(offset);

I've opened a PR with this fix plus a regression test: (will link once created)