In ShadowRoot::setInnerHTML, host() is used for context element to createFragmentForInnerOuterHTML(). This changes the behavior of shadowRoot.innerHTML = "..." if the host element is changed. e.g. For <textarea>, almost of tags will be ignored.
Created attachment 152955 [details] Repro
In the repro, shadowRoot1.innerHTML.firstChild and shadowRoot2.innerHTML.firstChild should be the same. However, since xmp does not accept any tag, shadowRoot1.firstChild is a text node and shadowRoot2.firstChild is an anchor node.
I'm trying to attack this now. Changing Element to ContainerNode worked, but I'm not sure It's OK.
I've filed the Bug in the spec... https://www.w3.org/Bugs/Public/show_bug.cgi?id=18321 Using the host element's parsing rule seems natural to me now, but we have to care about what the host element is when using innerHTML.
Since the spec was updated so that the host element is used for parsing context element, this bug is now invalid.