Only allow reprojecting shadows between ShadowRoots of the same type

Source/core/dom/shadow/ElementShadow.cpp

Index: Source/core/dom/shadow/ElementShadow.cpp
diff --git a/Source/core/dom/shadow/ElementShadow.cpp b/Source/core/dom/shadow/ElementShadow.cpp
index b6eef01639011b239d501a890805a0260d668d27..bdd09138e2ab2ac36e66f37442f3975d02156c86 100644
--- a/Source/core/dom/shadow/ElementShadow.cpp
+++ b/Source/core/dom/shadow/ElementShadow.cpp
@@ -234,12 +234,12 @@ void ElementShadow::distribute()
         HTMLShadowElement* shadowElement = activeShadowInsertionPoints[i - 1];
         ShadowRoot* root = shadowElement->containingShadowRoot();
         ASSERT(root);
-        if (!shadowElement->shouldSelect()) {
-            if (root->olderShadowRoot())
+        if (root->olderShadowRoot()) {
+            // Disallow reprojecting UA shadows into author shadows.
+            if (root->olderShadowRoot()->type() == root->type()) {
+                distributeNodeChildrenTo(shadowElement, root->olderShadowRoot());
                 root->olderShadowRoot()->ensureScopeDistribution()->setInsertionPointAssignedTo(shadowElement);
-        } else if (root->olderShadowRoot()) {
-            distributeNodeChildrenTo(shadowElement, root->olderShadowRoot());
-            root->olderShadowRoot()->ensureScopeDistribution()->setInsertionPointAssignedTo(shadowElement);
+            }
         } else {
             distributeSelectionsTo(shadowElement, pool, distributed);
         }