Suppose we are visiting a Single Page Application(SPA), which url on the browser is "https://xxxxxxx.com/home/self". Since this is a SPA, website server has no real html located in 'https://xxxxxxx.com/home/self', it just has a single html, which located in 'https://xxxxxxx.com', as for other path such as 'home/self', it is just html5 history api. ``` documentClone.adoptNode(this.documentElement) ``` Let me explain more: documentClone is just a empty page, which html structure is like: `<html><head></head><body></body></html>`. this.documentElement is another document, and we can suppose it is loaded from another website page, we call it Page A later. Page A is a Single Page Application, which url is like: "https://xxxxxxx.com/home/self". this.documentElement has a `<img>` child, which structure is like "<html> ... <img id="img" src="assets/aa/bb.png"> ...</html>". Befor calling `documentClone.adoptNode(this.documentElement)`, when i run `this.documentElement.getElementById('img').currentSrc`, it will return "https://xxxxxxx.com/assets/aa/bb.png". After calling `documentClone.adoptNode(this.documentElement).getElementById('img').currentSrc`, it will return "https://xxxxxxx.com/home/self/assets/aa/bb.png" Other browsers will return "https://xxxxxxx.com/assets/aa/bb.png", and before Safari 15.4(MacOS) it will return "https://xxxxxxx.com/assets/aa/bb.png". But for Safari 15.4(MacOS), it will return "https://xxxxxxx.com/home/self/assets/aa/bb.png". Maybe this is produced along with Safari 15.4 release.
rdar://92171839
Thanks for filing, can you please provide a link to a reduced test case?