Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 31f6b383f7bee361fcdbe99b5f96f31052bc9f8b
https://github.com/WebKit/WebKit/commit/31f6b383f7bee361fcdbe99b5f96f31052bc9f8b
Author: Wenson Hsieh <[email protected]>
Date: 2026-07-02 (Thu, 02 Jul 2026)
Changed paths:
M Source/WebCore/editing/TextIterator.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm
Log Message:
-----------
[iOS 27] chemicalguys.com sometimes hangs under
TextExtraction::extractAllTextAndRects()
https://bugs.webkit.org/show_bug.cgi?id=318407
rdar://180538072
Reviewed by Abrar Rahman Protyasha.
Consider the case where `TextIterator` (with the `TraversesFlatTree` option
specified) traverses the
following content:
```
<details>
<details>x<summary></summary></details>
</details>
```
(with DOM tree)
```
<body 0x10b3102b0>
<details 0x10b3580b0>
<details 0x10b358160>
"x" 0x10b3682a0
<summary 0x10b364220>
```
...after descending into the `summary` element (`0x10b364220`), we ascend to
the summary's assigned
slot; from there, `nextSibling` gives the sibling (content) slot, whose first
assigned node is the
text node `"x"`. `"x"`'s next sibling is the `summary` again. As a result, we
bounce between the
`summary` element, its assigned `slot`, and the containing UA shadow root under
the `details`
element.
To fix this, align the behavior of `TraversesFlatTree` to
`assignedSlotIgnoringUserAgentShadow` in
`ComposedTreeIterator.h`, and skip slot elements in UA shadow roots when
ascending the tree.
Test: TextExtractionTests.NestedDetailsDoesNotHang
* Source/WebCore/editing/TextIterator.cpp:
(WebCore::parentInComposedTreeIgnoringUserAgentShadow):
(WebCore::parentNodeOrShadowHost):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:
(TestWebKitAPI::NestedDetailsDoesNotHang)):
Canonical link: https://commits.webkit.org/316430@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
