SelectorChecker::parentElement should walk up to ShadowHost only if an element is in a shadow tree …

Source/core/css/SelectorChecker.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2004-2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Nicholas Shanks (webkit@nickshanks.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (c) 2011, Code Aurora Forum. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
@@ skipping 66 matching lines @@
     return true;
 }
 
 Element* SelectorChecker::parentElement(const SelectorCheckingContext& context, bool allowToCrossBoundary) const
 {
     // CrossesBoundary means we don't care any context.scope. So we can walk up from a shadow root to its shadow host.
     if (allowToCrossBoundary)
         return context.element->parentOrShadowHostElement();
 
     // If context.scope is a shadow host, we should walk up from a shadow root to its shadow host.
-    if (context.behaviorAtBoundary & SelectorChecker::ScopeIsShadowHost)
+    if ((context.behaviorAtBoundary & SelectorChecker::ScopeIsShadowHost) && context.scope == context.element->shadowHost())
         return context.element->parentOrShadowHostElement();
 
     if ((context.behaviorAtBoundary & SelectorChecker::BoundaryBehaviorMask) != SelectorChecker::StaysWithinTreeScope)
         return context.element->parentElement();
 
     // If context.scope is some element in some shadow tree and querySelector initialized the context,
     // e.g. shadowRoot.querySelector(':host *'),
     // (a) context.element has the same treescope as context.scope, need to walk up to its shadow host.
     // (b) Otherwise, should not walk up from a shadow root to a shadow host.
     if (context.scope && context.scope->treeScope() == context.element->treeScope())
@@ skipping 1044 matching lines @@
     return element.focused() && isFrameFocused(element);
 }
 
 template
 SelectorChecker::Match SelectorChecker::match(const SelectorCheckingContext&, const DOMSiblingTraversalStrategy&, MatchResult*) const;
 
 template
 SelectorChecker::Match SelectorChecker::match(const SelectorCheckingContext&, const ShadowDOMSiblingTraversalStrategy&, MatchResult*) const;
 
 }