1 files changed, 7 insertions, 1 deletions
diff --git a/dom/serializers/nsDocumentEncoder.cpp b/dom/serializers/nsDocumentEncoder.cpp
index 14120bae64..46ea15fecc 100644
--- a/dom/serializers/nsDocumentEncoder.cpp
+++ b/dom/serializers/nsDocumentEncoder.cpp
@@ -1270,8 +1270,14 @@ nsresult nsDocumentEncoder::RangeSerializer::SerializeRangeToString(
     const nsRange* aRange) {
   if (!aRange || aRange->Collapsed()) return NS_OK;
 
+  // Consider a case where the boundary of the selection is ShadowRoot (ie, the
+  // first child of ShadowRoot is selected, so ShadowRoot is the container hence
+  // the boundary), allowing GetClosestCommonInclusiveAncestor to cross the
+  // boundary can return the host element as the container.
+  // SerializeRangeContextStart doesn't support this case.
   mClosestCommonInclusiveAncestorOfRange =
-      aRange->GetClosestCommonInclusiveAncestor();
+      aRange->GetClosestCommonInclusiveAncestor(
+          AllowRangeCrossShadowBoundary::No);
 
   if (!mClosestCommonInclusiveAncestorOfRange) {
     return NS_OK;