Cherry-pick WebKit change r92139 to fix a LayoutTest crash

editing/input/search-field-crash-in-designmode.html

Manually resolved a merge conflict in CSSStyleSelector::isAtShadowBoundary()
due to http://trac.webkit.org/changeset/88476.

See http://trac.webkit.org/changeset/92139

Bug: 6329073
Change-Id: If869bd58a689bb918ef47048c4f5d2e84e4b6f89

2 files changed, 14 insertions, 10 deletions

diff --git a/Source/WebCore/css/CSSStyleSelector.cpp b/Source/WebCore/css/CSSStyleSelector.cpp
index 8edf0dd..613bf4a 100644
--- a/Source/WebCore/css/CSSStyleSelector.cpp
+++ b/Source/WebCore/css/CSSStyleSelector.cpp
@@ -1237,6 +1237,15 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForDocument(Document* document)
     return documentStyle.release();
 }
 
+static inline bool isAtShadowBoundary(Element* element)
+{
+    if (!element)
+        return false;
+
+    ContainerNode* parentNode = element->parentNode();
+    return parentNode && parentNode->isShadowBoundary();
+}
+
 // If resolveForRootDefault is true, style based on user agent style sheet only. This is used in media queries, where
 // relative units are interpreted according to document root element style, styled only with UA stylesheet
 
@@ -1279,6 +1288,10 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* e, RenderStyl
         initForStyleResolve(e, defaultParent);
     }
 
+    // Don't propagate user-modify into shadow DOM
+    if (isAtShadowBoundary(e))
+        m_style->setUserModify(RenderStyle::initialUserModify());
+
     m_checker.m_matchVisitedPseudoClass = matchVisitedPseudoClass;
 
     m_style = RenderStyle::create();
@@ -1773,15 +1786,6 @@ static void addIntrinsicMargins(RenderStyle* style)
     }
 }
 
-static inline bool isAtShadowBoundary(Element* element)
-{
-    if (!element)
-        return false;
-
-    ContainerNode* parentNode = element->parentNode();
-    return parentNode && parentNode->isShadowBoundary();
-}
-
 void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, RenderStyle* parentStyle, Element *e)
 {
     // Cache our original display.
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index da4312c..ec5c423 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -770,7 +770,7 @@ bool Node::isContentEditable() const
 
 bool Node::rendererIsEditable(EditableLevel editableLevel) const
 {
-    if (document()->frame() && document()->frame()->page() && document()->frame()->page()->isEditable())
+    if (document()->frame() && document()->frame()->page() && document()->frame()->page()->isEditable() && !shadowTreeRootNode())
         return true;
 
     // Ideally we'd call ASSERT(!needsStyleRecalc()) here, but