Matching part for >>> (shadow-piercing descendant combinator).

third_party/WebKit/Source/core/css/SelectorChecker.cpp

Index: third_party/WebKit/Source/core/css/SelectorChecker.cpp
diff --git a/third_party/WebKit/Source/core/css/SelectorChecker.cpp b/third_party/WebKit/Source/core/css/SelectorChecker.cpp
index 6b291af9b82dec208f2bf063b17a570d4c331932..c0057dd77225f8166097922f7fb3dac1fe35875c 100644
--- a/third_party/WebKit/Source/core/css/SelectorChecker.cpp
+++ b/third_party/WebKit/Source/core/css/SelectorChecker.cpp
@@ -285,6 +285,14 @@ static inline Element* parentOrV0ShadowHostElement(const Element& element) {
   return element.parentOrShadowHostElement();
 }
 
+static inline Element* parentOrOpenShadowHostElement(const Element& element) {
+  if (element.parentNode() && element.parentNode()->isShadowRoot()) {
+    if (toShadowRoot(element.parentNode())->type() != ShadowRootType::Open)
+      return nullptr;

[rune, 2016/11/17 10:05:25]

So this can happen if you start querying inside a closed tree and try to escape
during matching?

<div class="a"></div>
  <div id="host">
    <:shadow-root closed>
      <div id="scoping">
        <div class="b"></div>
      </div>
    </:shadow-root>
  </div>
</div>

  scoping.querySelector(".a >>> .b");

If you do:

  document.querySelector(".a >>> .b");

you could avoid traversing down the closed shadow tree and the code above would
not be hit?

[kochi, 2016/11/18 07:31:21]

We filter out closed and user-agent shadow roots in SelectorQuery.cpp,
but V0 shadow roots are included, so we have to exclude V0 shadow
roots here.

[rune, 2016/11/18 09:16:01]

Acknowledged.

+  }
+  return element.parentOrShadowHostElement();
+}
+
 SelectorChecker::Match SelectorChecker::matchForRelation(
     const SelectorCheckingContext& context,
     MatchResult& result) const {
@@ -397,7 +405,6 @@ SelectorChecker::Match SelectorChecker::matchForRelation(
       return matchSelector(nextContext, result);
     }
 
-    case CSSSelector::ShadowPiercingDescendant:
     case CSSSelector::ShadowDeep: {
       if (!m_isUARule && !m_isQuerySelector)
         Deprecation::countDeprecation(context.element->document(),
@@ -439,6 +446,27 @@ SelectorChecker::Match SelectorChecker::matchForRelation(
       return SelectorFailsCompletely;
     }
 
+    case CSSSelector::ShadowPiercingDescendant: {
+      DCHECK(m_isQuerySelector);
+      if (ShadowRoot* root = context.element->containingShadowRoot()) {
+        if (root->type() == ShadowRootType::UserAgent)

[rune, 2016/11/17 10:05:25]

Will you be able to end up here at all? Doesn't that mean the dom traversal in
querySelector enter UA shadow trees? Does it? Should it?

[kochi, 2016/11/18 07:31:21]

Good catch, removed.
(the wip version naively copied most of the parts from /deep/ matching
logic.)

[rune, 2016/11/18 09:16:02]

Perhaps you should DCHECK that the shadow root type is not UserAgent in
parentOrOpenShadowHostElement?

+          return SelectorFailsCompletely;
+      }
+
+      for (nextContext.element =
+               parentOrOpenShadowHostElement(*context.element);
+           nextContext.element;
+           nextContext.element =
+               parentOrOpenShadowHostElement(*nextContext.element)) {
+        Match match = matchSelector(nextContext, result);
+        if (match == SelectorMatches || match == SelectorFailsCompletely)
+          return match;
+        if (nextSelectorExceedsScope(nextContext))
+          break;
+      }
+      return SelectorFailsCompletely;
+    }
+
     case CSSSelector::ShadowSlot: {
       const HTMLSlotElement* slot = findSlotElementInScope(context);
       if (!slot)