Text control elements should contain all (shadow DOM) children.

third_party/WebKit/Source/core/layout/LayoutBlock.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc.
  *               All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 221 matching lines @@
           cb->insertPositionedObject(this);
         }
       }
     }
   }
 
   if (TextAutosizer* textAutosizer = document().textAutosizer())
     textAutosizer->record(this);
 
   propagateStyleToAnonymousChildren();
+
+  // The LayoutView is always a container of fixed positioned descendants. In
+  // addition, SVG foreignObjects become such containers, so that descendants
+  // of a foreignObject cannot escape it. Similarly, text controls let authors
+  // select elements inside that are created by user agent shadow DOM, and we
+  // have (C++) code that assumes that the elements are indeed contained by the
+  // text control. So just make sure this is the case. Finally, computed style
+  // may turn us into a container of all things, e.g. if the element is
+  // transformed, or contain:paint is specified.
   setCanContainFixedPositionObjects(isLayoutView() || isSVGForeignObject() ||
+                                    isTextControl() ||
                                     newStyle.canContainFixedPositionObjects());
 
   // It's possible for our border/padding to change, but for the overall logical
   // width or height of the block to end up being the same. We keep track of
   // this change so in layoutBlock, we can know to set relayoutChildren=true.
   m_widthAvailableToChildrenChanged |=
       oldStyle && needsLayout() &&
       (diff.needsFullLayout() || borderOrPaddingLogicalDimensionChanged(
                                      *oldStyle, newStyle, LogicalWidth));
   m_heightAvailableToChildrenChanged |= oldStyle && diff.needsFullLayout() &&
@@ skipping 1964 matching lines @@
   }
 
   return availableHeight;
 }
 
 bool LayoutBlock::hasDefiniteLogicalHeight() const {
   return availableLogicalHeightForPercentageComputation() != LayoutUnit(-1);
 }
 
 }  // namespace blink