[Shadow] offsetParent should never return nodes in user agent Shadow DOM to script
https://bugs.webkit.org/show_bug.cgi?id=112530

Reviewed by Elliott Sprehn.

Source/WebCore:

Test: fast/dom/shadow/offset-parent-does-not-leak-ua-shadow.html

* dom/Element.cpp:
(WebCore::Element::bindingsOffsetParent): Filter nodes in UA shadows.
* dom/Element.h:
(Element): Add bindingsOffsetParent.
* dom/Element.idl: bindingsOffsetParent is the implementation of offsetParent.

LayoutTests:

* fast/dom/shadow/offset-parent-does-not-leak-ua-shadow-expected.txt: Added.
* fast/dom/shadow/offset-parent-does-not-leak-ua-shadow.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146037 268f45cc-cd09-0410-ab3c-d52691b4dbfc