4696a1ed97
Problem: Selection.containsNode() crashes when the selection’s range has boundary points in a tree that’s not connected — such as a shadow tree whose host was removed. We also call that function internally for content-visibility:auto elements during rendering — so it can cause a page to crash even when the page itself doesn’t use the Selection API. Cause: When a shadow host is removed, a selection range whose boundary points are inside its shadow tree isn’t adjusted: live-range adjustment matches ranges by regular-tree descendant and doesn’t reach into shadow trees. The range is left pointing into the detached shadow tree. contains_node() verifies only the passed node against the document — not the range — then runs a boundary-point comparison that requires both sides to share a shadow-including root. Fix: Make contains_node() also confirm the range’s boundary points are rooted at the document. If not, then return false — because a node can’t be contained in a selection whose range is in a different tree. Fixes https://github.com/LadybirdBrowser/ladybird/issues/9469 |
||
|---|---|---|
| .. | ||
| Selection.cpp | ||
| Selection.h | ||
| Selection.idl | ||