Text control elements should contain all (shadow DOM) children.

third_party/WebKit/Source/core/layout/LayoutBlock.cpp

Index: third_party/WebKit/Source/core/layout/LayoutBlock.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutBlock.cpp b/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
index 841db4b205808d10e89768392d1ad3c662705690..7aa6ac9b9597bf7be00230dd6c2fce164c8098bc 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
@@ -239,7 +239,17 @@ void LayoutBlock::styleDidChange(StyleDifference diff,
     textAutosizer->record(this);
 
   propagateStyleToAnonymousChildren();
+
+  // The LayoutView is always a container of fixed positioned descendants. In
+  // addition, SVG foreignObjects become such containers, so that descendants
+  // of a foreignObject cannot escape it. Similarly, text controls let authors
+  // select elements inside that are created by user agent shadow DOM, and we
+  // have (C++) code that assumes that the elements are indeed contained by the
+  // text control. So just make sure this is the case. Finally, computed style
+  // may turn us into a container of all things, e.g. if the element is
+  // transformed, or contain:paint is specified.
   setCanContainFixedPositionObjects(isLayoutView() || isSVGForeignObject() ||
+                                    isTextControl() ||
                                     newStyle.canContainFixedPositionObjects());
 
   // It's possible for our border/padding to change, but for the overall logical