Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 15f8402bcf9a852608f37824fb3f5d048e7d63dd
https://github.com/WebKit/WebKit/commit/15f8402bcf9a852608f37824fb3f5d048e7d63dd
Author: Ahmad Saleem <[email protected]>
Date: 2026-10-06 (Tue, 06 Oct 2026)
Changed paths:
A
LayoutTests/fast/dom/Range/range-end-moved-out-of-common-root-during-iframe-unload-expected.txt
A
LayoutTests/fast/dom/Range/range-end-moved-out-of-common-root-during-iframe-unload.html
M Source/WebCore/dom/Range.cpp
Log Message:
-----------
Range::processContents() checks the live end container instead of the saved
original end
https://bugs.webkit.org/show_bug.cgi?id=326459
rdar://189262302
Reviewed by Ryosuke Niwa.
This patch aligns WebKit with Gecko / Firefox.
Range::processContents() saves the original boundary points because script can
run while nodes are being removed. However, the right-hand check used the live
endContainer() instead of originalEnd.container().
If the end was originally the common ancestor and script moved it into a
descendant, for example from an iframe unload handler, the common ancestor
itself was processed as the end container. processAncestorsAndTheirSiblings()
then walked up to the document and removed every preceding sibling of every
ancestor, including <head> and the doctype.
Use originalEnd.container(), matching the start side.
Test:
fast/dom/Range/range-end-moved-out-of-common-root-during-iframe-unload.html
*
LayoutTests/fast/dom/Range/range-end-moved-out-of-common-root-during-iframe-unload-expected.txt:
Added.
*
LayoutTests/fast/dom/Range/range-end-moved-out-of-common-root-during-iframe-unload.html:
Added.
* Source/WebCore/dom/Range.cpp:
(WebCore::Range::processContents):
Canonical link: https://commits.webkit.org/322920@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
