Related bug:  695949 .

Maybe this because SVG child elements are parsed in "foreign" mode?

I guess relevant pieces may be:

https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp?type=cs&l=304
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/css/SelectorChecker.cpp?type=cs&l=97

This CL might give some pointers:

https://chromium.googlesource.com/chromium/src/+/bab4aa7b93135dff88e7afb14b93ec7786768c1c

Thanks, I think I see where this goes awry now.

Are you going to take the bug then?

I haven't really figured how to fix it yet, but sure I can assign it to me for now.

Also, this is only a problem in HTML documents, not SVG documents.

Any update on this bug? Is it harder than it seems?

I haven't looked into it any deeper yet (it's a P3.) I don't expect it to be trivial to make a non-hacky fix though.

I think this is actually a P2. foreignObject features are being fixed in batch
as part of SPv175.

This is what's causing external/wpt/svg/extensibility/foreignObject/foreign-object-size.html to fail as well.

I'll do this ...

https://chromium-review.googlesource.com/c/chromium/src/+/1290849

Thanks!

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ac2d95815375fcd6e70c6c491c4bdbda25b181b8

commit ac2d95815375fcd6e70c6c491c4bdbda25b181b8
Author: Rune Lillesveen <futhark@chromium.org>
Date: Fri Oct 19 11:56:09 2018

Collect type selector rules case-sensitively in UA sheets.

Selectors in UA sheets are added case-sensitively to RuleSet buckets as
if they were sheets in non-HTML documents in order to match correctly
for xhtml and svg documents. That means we should not use the lower-case
element name to lookup element rules as the lower-case of foreignObject
would not find the foreignObject rules from the element bucket in the
svg.css UA stylesheet.

Bug:  819814 
Change-Id: I2064f6669f6b7021feab2c93dd6b4d8a5c749b77
Reviewed-on: https://chromium-review.googlesource.com/c/1290849
Reviewed-by: Fredrik Söderquist <fs@opera.com>
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#601116}
[modify] https://crrev.com/ac2d95815375fcd6e70c6c491c4bdbda25b181b8/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/ac2d95815375fcd6e70c6c491c4bdbda25b181b8/third_party/WebKit/LayoutTests/fast/multicol/span/sole-svg-spanner-with-foreignObject-crash.html
[modify] https://crrev.com/ac2d95815375fcd6e70c6c491c4bdbda25b181b8/third_party/WebKit/LayoutTests/paint/invalidation/svg/transform-foreign-object.html
[modify] https://crrev.com/ac2d95815375fcd6e70c6c491c4bdbda25b181b8/third_party/WebKit/LayoutTests/svg/foreign-object-under-shadow-root-under-hidden-expected.txt
[modify] https://crrev.com/ac2d95815375fcd6e70c6c491c4bdbda25b181b8/third_party/WebKit/LayoutTests/svg/foreignObject/clip.html
[modify] https://crrev.com/ac2d95815375fcd6e70c6c491c4bdbda25b181b8/third_party/blink/renderer/core/css/element_rule_collector.cc
[modify] https://crrev.com/ac2d95815375fcd6e70c6c491c4bdbda25b181b8/third_party/blink/renderer/core/layout/svg/layout_svg_foreign_object_test.cc
[modify] https://crrev.com/ac2d95815375fcd6e70c6c491c4bdbda25b181b8/third_party/blink/renderer/core/paint/paint_property_tree_builder_test.cc

 Issue 587108  has been merged into this issue.