Update owner document of Range objects if start/end boundary points in different document

Source/core/dom/Range.cpp

Index: Source/core/dom/Range.cpp
diff --git a/Source/core/dom/Range.cpp b/Source/core/dom/Range.cpp
index 344fc42d6970d9be55a7631bed5187c8f9164b97..10e4029cd0d6d752462117ea2f51264371c24b63 100644
--- a/Source/core/dom/Range.cpp
+++ b/Source/core/dom/Range.cpp
@@ -1544,6 +1544,19 @@ void Range::didMergeTextNodes(const NodeWithIndex& oldNode, unsigned offset)
     boundaryTextNodesMerged(m_end, oldNode, offset);
 }
 
+void Range::updateOwnerDocumentIfNeeded()
+{
+    ASSERT(m_start.container());
+    ASSERT(m_end.container());
+    Document& newDocument = m_start.container()->document();
+    ASSERT(newDocument == m_end.container()->document());
+    if (newDocument == m_ownerDocument)
+        return;
+    m_ownerDocument->detachRange(this);
+    m_ownerDocument = &newDocument;
+    m_ownerDocument->attachRange(this);

[Yuta Kitamura, 2014/06/18 03:22:37]

I'm not sure migrating to another document is an expected
behavior. My reading of DOM spec tells the range should
stick to the same document.

How do other browsers behave?

[yosin_UTC9, 2014/06/18 08:55:40]

I checked FireFox and IE. Behavior is as same as Chrome with this patch with
http://jsfiddle.net/HYYZ7/1/

+}
+
 static inline void boundaryTextNodeSplit(RangeBoundaryPoint& boundary, Text& oldNode)
 {
     Node* boundaryContainer = boundary.container();