Update owner document of Range objects if start/end boundary points in different document

Source/core/dom/Range.cpp

 /*
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * (C) 2000 Gunnstein Lye (gunnstein@netcom.no)
  * (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
  * (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Motorola Mobility. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 1526 matching lines @@
 {
     ASSERT(oldNode.node().document() == m_ownerDocument);
     ASSERT(oldNode.node().parentNode());
     ASSERT(oldNode.node().isTextNode());
     ASSERT(oldNode.node().previousSibling());
     ASSERT(oldNode.node().previousSibling()->isTextNode());
     boundaryTextNodesMerged(m_start, oldNode, offset);
     boundaryTextNodesMerged(m_end, oldNode, offset);
 }
 
+void Range::updateOwnerDocumentIfNeeded()
+{
+    ASSERT(m_start.container());
+    ASSERT(m_end.container());
+    Document& newDocument = m_start.container()->document();
+    ASSERT(newDocument == m_end.container()->document());
+    if (newDocument == m_ownerDocument)
+        return;
+    m_ownerDocument->detachRange(this);
+    m_ownerDocument = &newDocument;
+    m_ownerDocument->attachRange(this);

[Yuta Kitamura, 2014/06/18 03:22:37]

I'm not sure migrating to another document is an expected
behavior. My reading of DOM spec tells the range should
stick to the same document.

How do other browsers behave?

[yosin_UTC9, 2014/06/18 08:55:40]

I checked FireFox and IE. Behavior is as same as Chrome with this patch with
http://jsfiddle.net/HYYZ7/1/

+}
+
 static inline void boundaryTextNodeSplit(RangeBoundaryPoint& boundary, Text& oldNode)
 {
     Node* boundaryContainer = boundary.container();
     unsigned boundaryOffset = boundary.offset();
     if (boundary.childBefore() == &oldNode)
         boundary.set(boundaryContainer, boundaryOffset + 1, oldNode.nextSibling());
     else if (boundary.container() == &oldNode && boundaryOffset > oldNode.length())
         boundary.set(oldNode.nextSibling(), boundaryOffset - oldNode.length(), 0);
 }
 
@@ skipping 114 matching lines @@
 
 void showTree(const WebCore::Range* range)
 {
     if (range && range->boundaryPointsValid()) {
         range->startContainer()->showTreeAndMark(range->startContainer(), "S", range->endContainer(), "E");
         fprintf(stderr, "start offset: %d, end offset: %d\n", range->startOffset(), range->endOffset());
     }
 }
 
 #endif