Created attachment 147515 [details] Repro Select from inside of <span contenteditable>hoge</span> to table.
Try selection twice. The first selection won't break the boundary... I don't know why.
I and rniwa investigated this issue. The problem will be m_style->inheritFrom() in StyleResolver::applyMatchedProperty(). Actually inheritFrom() does not copy "-webkit-user-modify" (i.e. contenteditable) if the element is on the shadow boundary (element's host is ShadowRoot). Maybe inheritFrom() is abused in various places to copy inherit values... We should create another function copyFrom() for the purpose.
Actually this bug seems caused by the patch for Bug 88514. Bug 88514 test case will be failed if I made a patch like the last comment... I should investigate this more..., but it seems I'm moving forward.
Created attachment 148650 [details] Patch
Comment on attachment 148650 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=148650&action=review > Source/WebCore/css/StyleResolver.cpp:2952 > - if (m_parentStyle->inheritedDataShared(cacheItem->parentRenderStyle.get())) { > + if (m_parentStyle->inheritedDataShared(cacheItem->parentRenderStyle.get()) && !isAtShadowBoundary(element)) { I see. The problem is that the parent renderer is the shadow host so we're tricked to think that this element's style matches that of a "light" child of the shadow host (outside of the shadow DOM). This patch looks right but probably needs kling or antti's blessing.
Comment on attachment 148650 [details] Patch Clearing flags on attachment: 148650 Committed r120887: <http://trac.webkit.org/changeset/120887>
All reviewed patches have been landed. Closing bug.