The element under mouse should be in hover state even if its not inActiveChain.

Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved.
@@ skipping 5460 matching lines @@
         if (oldHoverNode && !oldHoverObj) {
             for (Node* node = oldHoverNode.get(); node; node = node->parentNode()) {
                 if (!mustBeInActiveChain || (node->isElementNode() && toElement(node)->inActiveChain()))
                     nodesToRemoveFromChain.append(node);
             }
 
         }
 
         // The old hover path only needs to be cleared up to (and not including) the common ancestor;
         for (RenderObject* curr = oldHoverObj; curr && curr != ancestor; curr = curr->hoverAncestor()) {
-            if (curr->node() && !curr->isText() && (!mustBeInActiveChain || curr->node()->inActiveChain()))
+            if (curr->node() && !curr->isText() && (!mustBeInActiveChain || curr->node()->inActiveChain() || curr == oldHoverObj))

[Rick Byers, 2014/06/12 18:24:06]

This doesn't look like the right fix to me.  How does your patch change the
behavior of this (more general) test case: http://jsbin.com/rider/2/?  If we're
going to fix this bug then I'd expect Chrome's behavior to match Firefox -
namely that hover is cleared on all nodes that are no longer under the mouse and
applied to all nodes that are now under the mouse.  You seem to be special
casing the innermost node here.

Also the behavior we have today seems to be intentional given this comment
above: 
  // If the mouse is down and if this is a mouse move event, we want to restrict
changes in
  // :hover/:active to only apply to elements that are in the :active chain that
we froze
  // at the time the mouse went down.

Changing this seems reasonable to me (I see no reason to freeze the hover chain,
but freezing the active chain makes sense).  But you should update the comment
and overall structure of this code to do that, and make sure you're handling all
the different sub-cases consistently.  Perhaps you just need to remove the
'mustBeInActiveChain' logic?

                 nodesToRemoveFromChain.append(curr->node());
         }
     }
 
     // Now set the hover state for our new object up to the root.
     for (RenderObject* curr = newHoverObj; curr; curr = curr->hoverAncestor()) {
-        if (curr->node() && !curr->isText() && (!mustBeInActiveChain || curr->node()->inActiveChain()))
+        if (curr->node() && !curr->isText() && (!mustBeInActiveChain || curr->node()->inActiveChain() || curr == newHoverObj))
             nodesToAddToChain.append(curr->node());
     }
 
     // mouseenter and mouseleave events do not bubble, so they are dispatched iff there is a capturing
     // event handler on an ancestor or a normal event handler on the element itself. This special
     // handling is necessary to avoid O(n^2) capturing event handler checks. We'll check the previously
     // hovered node's ancestor tree for 'mouseleave' handlers here, then check the newly hovered node's
     // ancestor tree for 'mouseenter' handlers after dispatching the 'mouseleave' events (as the handler
     // for 'mouseleave' might set a capturing 'mouseenter' handler, odd as that might be).
     bool ancestorHasCapturingMouseleaveListener = false;
@@ skipping 297 matching lines @@
     visitor->trace(m_timeline);
     visitor->trace(m_compositorPendingAnimations);
     visitor->registerWeakMembers<Document, &Document::clearWeakMembers>(this);
     DocumentSupplementable::trace(visitor);
     TreeScope::trace(visitor);
     ContainerNode::trace(visitor);
     ExecutionContext::trace(visitor);
 }
 
 } // namespace WebCore