Matching part for >>> (shadow-piercing descendant combinator).

third_party/WebKit/Source/core/css/SelectorChecker.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2004-2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Nicholas Shanks (webkit@nickshanks.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc.
  * All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
@@ skipping 267 matching lines @@
 }
 
 static inline Element* parentOrV0ShadowHostElement(const Element& element) {
   if (element.parentNode() && element.parentNode()->isShadowRoot()) {
     if (toShadowRoot(element.parentNode())->type() != ShadowRootType::V0)
       return nullptr;
   }
   return element.parentOrShadowHostElement();
 }
 
+static inline Element* parentOrOpenShadowHostElement(const Element& element) {
+  if (element.parentNode() && element.parentNode()->isShadowRoot()) {
+    if (toShadowRoot(element.parentNode())->type() != ShadowRootType::Open)
+      return nullptr;

[rune, 2016/11/17 10:05:25]

So this can happen if you start querying inside a closed tree and try to escape
during matching?

<div class="a"></div>
  <div id="host">
    <:shadow-root closed>
      <div id="scoping">
        <div class="b"></div>
      </div>
    </:shadow-root>
  </div>
</div>

  scoping.querySelector(".a >>> .b");

If you do:

  document.querySelector(".a >>> .b");

you could avoid traversing down the closed shadow tree and the code above would
not be hit?

[kochi, 2016/11/18 07:31:21]

We filter out closed and user-agent shadow roots in SelectorQuery.cpp,
but V0 shadow roots are included, so we have to exclude V0 shadow
roots here.

[rune, 2016/11/18 09:16:01]

Acknowledged.

+  }
+  return element.parentOrShadowHostElement();
+}
+
 SelectorChecker::Match SelectorChecker::matchForRelation(
     const SelectorCheckingContext& context,
     MatchResult& result) const {
   SelectorCheckingContext nextContext = prepareNextContextForRelation(context);
 
   CSSSelector::RelationType relation = context.selector->relation();
 
   // Disable :visited matching when we see the first link or try to match
   // anything else than an ancestors.
   if (!context.isSubSelector &&
@@ skipping 92 matching lines @@
               context.element->treeScope())
         return SelectorFailsCompletely;
 
       Element* shadowHost = context.element->ownerShadowHost();
       if (!shadowHost)
         return SelectorFailsCompletely;
       nextContext.element = shadowHost;
       return matchSelector(nextContext, result);
     }
 
-    case CSSSelector::ShadowPiercingDescendant:
     case CSSSelector::ShadowDeep: {
       if (!m_isUARule && !m_isQuerySelector)
         Deprecation::countDeprecation(context.element->document(),
                                       UseCounter::CSSDeepCombinator);
       if (ShadowRoot* root = context.element->containingShadowRoot()) {
         if (root->type() == ShadowRootType::UserAgent)
           return SelectorFailsCompletely;
       }
 
       if (context.selector->relationIsAffectedByPseudoContent()) {
@@ skipping 21 matching lines @@
           UseCounter::count(context.element->document(),
                             UseCounter::CSSDeepCombinatorAndShadow);
         if (match == SelectorMatches || match == SelectorFailsCompletely)
           return match;
         if (nextSelectorExceedsScope(nextContext))
           return SelectorFailsCompletely;
       }
       return SelectorFailsCompletely;
     }
 
+    case CSSSelector::ShadowPiercingDescendant: {
+      DCHECK(m_isQuerySelector);
+      if (ShadowRoot* root = context.element->containingShadowRoot()) {
+        if (root->type() == ShadowRootType::UserAgent)

[rune, 2016/11/17 10:05:25]

Will you be able to end up here at all? Doesn't that mean the dom traversal in
querySelector enter UA shadow trees? Does it? Should it?

[kochi, 2016/11/18 07:31:21]

Good catch, removed.
(the wip version naively copied most of the parts from /deep/ matching
logic.)

[rune, 2016/11/18 09:16:02]

Perhaps you should DCHECK that the shadow root type is not UserAgent in
parentOrOpenShadowHostElement?

+          return SelectorFailsCompletely;
+      }
+
+      for (nextContext.element =
+               parentOrOpenShadowHostElement(*context.element);
+           nextContext.element;
+           nextContext.element =
+               parentOrOpenShadowHostElement(*nextContext.element)) {
+        Match match = matchSelector(nextContext, result);
+        if (match == SelectorMatches || match == SelectorFailsCompletely)
+          return match;
+        if (nextSelectorExceedsScope(nextContext))
+          break;
+      }
+      return SelectorFailsCompletely;
+    }
+
     case CSSSelector::ShadowSlot: {
       const HTMLSlotElement* slot = findSlotElementInScope(context);
       if (!slot)
         return SelectorFailsCompletely;
 
       nextContext.element = const_cast<HTMLSlotElement*>(slot);
       return matchSelector(nextContext, result);
     }
 
     case CSSSelector::SubSelector:
@@ skipping 826 matching lines @@
 }
 
 bool SelectorChecker::matchesFocusPseudoClass(const Element& element) {
   if (InspectorInstrumentation::forcePseudoState(const_cast<Element*>(&element),
                                                  CSSSelector::PseudoFocus))
     return true;
   return element.isFocused() && isFrameFocused(element);
 }
 
 }  // namespace blink