tor-browser

commit 55123865236d92a915639254e9dab56768d23721
parent cc5f8e76ee67259f790a9a6c8050b45ef25197be
Author: Emilio Cobos Álvarez <emilio@crisal.io>
Date:   Wed,  7 Jan 2026 19:59:30 +0000

Bug 1992109 - Prevent NAC from showing up in CrossShadowBoundaryRange. r=smaug,jjaschke

Selection in NAC is generally only valid within the same anonymous
subtree, since NAC doesn't notify when unbinding. I don't think view
transitions are special here, I think you'd be able to hit it with other
NAC (but we don't have much "deep" NAC).

Differential Revision: https://phabricator.services.mozilla.com/D278163

Diffstat:
M
dom/base/nsRange.cpp
 | 
8
++++++++

1 file changed, 8 insertions(+), 0 deletions(-)
diff --git a/dom/base/nsRange.cpp b/dom/base/nsRange.cpp
@@ -3735,6 +3735,7 @@ void nsRange::CreateOrUpdateCrossShadowBoundaryRangeIfNeeded(
   // Nodes at least needs to be in the same document.
   if (startNode && endNode &&
       startNode->GetComposedDoc() != endNode->GetComposedDoc()) {
+    ResetCrossShadowBoundaryRange();
     return;
   }
 
@@ -3749,6 +3750,13 @@ void nsRange::CreateOrUpdateCrossShadowBoundaryRangeIfNeeded(
       return false;
     }
 
+    // We don't allow ranges to span different NAC subtrees (because we don't
+    // notify when unbinding NAC roots historically). nsRange can already deal
+    // with the "same anonymous subtree" case.
+    if (aContainer->IsInNativeAnonymousSubtree()) {
+      return false;
+    }
+
     // AbstractRange::GetClosestCommonInclusiveAncestor only supports
     // Document and Content nodes.
     return aContainer->IsDocument() || aContainer->IsContent();