When retrieving an attachment object from a range of the children, AX returns the wrong object
Created attachment 28158 [details]
patch to fix palindrom error
No tests added. Instead DumpRenderTree was changed to exercise the fixed code in WebCore. Layout tests continue to pass.
If this was landed then the bug should have been closed.