In the attached document, you can create a selection starting inside an input element and ending outside of the input element by a mouse drag.
Created attachment 92029 [details]
This is not a regression from Safari 5. I actually wonder if it's a bug or intended behavior.
(In reply to comment #2)
> This is not a regression from Safari 5. I actually wonder if it's a bug or intended behavior.
I don't think this can be an intended behavior. SelectionController has a selection that crosses the shadow boundary.
For what's worth, window.getSelection().toString() returns "" and baseNode and extentExtent of DOMSelection report incorrect nodes.
See also: bug 7275 (not very closely related).
Created attachment 92046 [details]
Here's a half-baked DRT test. I'm going to abandon this test and write a bunch of pixel tests because it can only indirectly check the behavior and it's not suitable as a regression test.
Created attachment 92049 [details]
fixes the bug
Created attachment 92050 [details]
The commit-queue encountered the following flaky tests while processing attachment 92050 [details]:
http/tests/xmlhttprequest/cross-origin-authorization.html bug 52398 (author: email@example.com)
The commit-queue is continuing to process your patch.
Comment on attachment 92050 [details]
Clearing flags on attachment: 92050
Committed r85669: <http://trac.webkit.org/changeset/85669>
All reviewed patches have been landed. Closing bug.