Issue #1593 - Follow-up: Fix :host matching from inside the shadow tree

Previously, we'd match :host despite the element having a different shadow root from the one that we currently have. Also, there's a test where :host should be blocked from matching if it is a descendant of an explicit universal selector.

1 files changed, 19 insertions, 1 deletions

diff --git a/layout/style/nsCSSRuleProcessor.cpp b/layout/style/nsCSSRuleProcessor.cpp
index dc2157084b..14ab270b86 100644
--- a/layout/style/nsCSSRuleProcessor.cpp
+++ b/layout/style/nsCSSRuleProcessor.cpp
@@ -1944,17 +1944,35 @@ static bool SelectorMatches(Element* aElement,
 
       case CSSPseudoClassType::host:
         {
+          ShadowRoot* shadow = aElement->GetShadowRoot();
           // In order to match :host, the element must be a shadow root host,
           // we must be matching only against host pseudo selectors, and the 
           // selector's context must be the shadow root (the selector must be 
           // featureless, the left-most selector, and be in a shadow root 
           // style). 
-          if (!aElement->GetShadowRoot() ||
+          if (!shadow ||
               aSelector->HasFeatureSelectors() ||
               aSelectorFlags & SelectorMatchesFlags::IS_HOST_INACCESSIBLE) {
             return false;
           }
 
+          // We're matching :host from inside the shadow root.
+          if (!aTreeMatchContext.mOnlyMatchHostPseudo) {
+            // Check if the element has the same shadow root.
+            if (aTreeMatchContext.mScopedRoot) {
+              if (shadow !=
+                  aTreeMatchContext.mScopedRoot->GetShadowRoot()) {
+                return false;
+              }
+            }
+            // We were called elsewhere.
+          }
+
+          // Reject if the next selector is an explicit universal selector.
+          if (aSelector->mNext && aSelector->mNext->mExplicitUniversal) {
+            return false;
+          }
+
           // The :host selector may also be be functional, with a compound
           // selector. If this is the case, then also ensure that the host
           // element matches against the compound selector.