Only :host and :ancestor should ever match the host in a ShadowRoot

Source/core/css/SelectorChecker.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2004-2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Nicholas Shanks (webkit@nickshanks.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (c) 2011, Code Aurora Forum. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
@@ skipping 473 matching lines @@
 template<typename SiblingTraversalStrategy>
 bool SelectorChecker::checkOne(const SelectorCheckingContext& context, const SiblingTraversalStrategy& siblingTraversalStrategy, unsigned* specificity) const
 {
     ASSERT(context.element);
     Element& element = *context.element;
     ASSERT(context.selector);
     const CSSSelector& selector = *context.selector;
 
     bool elementIsHostInItsShadowTree = isHostInItsShadowTree(element, context.behaviorAtBoundary, context.scope);
 
+    // Only :host and :ancestor should match the host: http://drafts.csswg.org/css-scoping/#host-element
+    if (elementIsHostInItsShadowTree && !selector.isHostPseudoClass())
+        return false;
+
     if (selector.m_match == CSSSelector::Tag)
-        return SelectorChecker::tagMatches(element, selector.tagQName()) && !elementIsHostInItsShadowTree;
+        return SelectorChecker::tagMatches(element, selector.tagQName());
 
     if (selector.m_match == CSSSelector::Class)
-        return element.hasClass() && element.classNames().contains(selector.value()) && !elementIsHostInItsShadowTree;
+        return element.hasClass() && element.classNames().contains(selector.value());
 
     if (selector.m_match == CSSSelector::Id)
-        return element.hasID() && element.idForStyleResolution() == selector.value() && !elementIsHostInItsShadowTree;
+        return element.hasID() && element.idForStyleResolution() == selector.value();
 
     if (selector.isAttributeSelector()) {
-        if (elementIsHostInItsShadowTree)
-            return false;
         if (!anyAttributeMatches(element, static_cast<CSSSelector::Match>(selector.m_match), selector))
             return false;
     }
 
     if (selector.m_match == CSSSelector::PseudoClass) {
         // Handle :not up front.
         if (selector.pseudoType() == CSSSelector::PseudoNot) {
             SelectorCheckingContext subContext(context);
             subContext.isSubSelector = true;
             ASSERT(selector.selectorList());
@@ skipping 585 matching lines @@
     return element.focused() && isFrameFocused(element);
 }
 
 template
 SelectorChecker::Match SelectorChecker::match(const SelectorCheckingContext&, const DOMSiblingTraversalStrategy&, MatchResult*) const;
 
 template
 SelectorChecker::Match SelectorChecker::match(const SelectorCheckingContext&, const ShadowDOMSiblingTraversalStrategy&, MatchResult*) const;
 
 }