Only allow reprojecting shadows between ShadowRoots of the same type

Source/core/dom/shadow/ElementShadow.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Neither the name of Google Inc. nor the names of its
@@ skipping 216 matching lines @@
         }
 
         if (firstActiveShadowInsertionPoint)
             activeShadowInsertionPoints.append(firstActiveShadowInsertionPoint);
     }
 
     for (size_t i = activeShadowInsertionPoints.size(); i > 0; --i) {
         HTMLShadowElement* shadowElement = activeShadowInsertionPoints[i - 1];
         ShadowRoot* root = shadowElement->containingShadowRoot();
         ASSERT(root);
-        if (!shadowElement->shouldSelect()) {
-            if (root->olderShadowRoot())
-                root->olderShadowRoot()->ensureScopeDistribution()->setInsertionPointAssignedTo(shadowElement);
-        } else if (root->olderShadowRoot()) {
+        if (root->olderShadowRoot() && root->olderShadowRoot()->type() == root->type()) {
+            // Only allow reprojecting older shadow roots between the same type to
+            // disallow reprojecting UA elements into author shadows.
             distributeNodeChildrenTo(shadowElement, root->olderShadowRoot());
             root->olderShadowRoot()->ensureScopeDistribution()->setInsertionPointAssignedTo(shadowElement);
-        } else {
+        } else if (!root->olderShadowRoot()) {
+            // There's assumed to always be a UA shadow that selects all nodes.
+            // We don't actually add it, instead we just distribute the pool to the
+            // <shadow> in the oldest shadow root.
             distributeSelectionsTo(shadowElement, pool, distributed);
         }
         if (ElementShadow* shadow = shadowOfParentForDistribution(shadowElement))
             shadow->setNeedsDistributionRecalc();
     }
 
     // Detach all nodes that were not distributed and have a renderer.
     for (size_t i = 0; i < pool.size(); ++i) {
         if (distributed[i])
             continue;
@@ skipping 98 matching lines @@
 {
     m_nodeToInsertionPoint.clear();
 
     for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
         if (ScopeContentDistribution* scope = root->scopeDistribution())
             scope->setInsertionPointAssignedTo(0);
     }
 }
 
 } // namespace