diff --git a/dom/base/CharacterData.cpp b/dom/base/CharacterData.cpp
index d96ea449621c..8cb03bd21de0 100644
--- a/dom/base/CharacterData.cpp
+++ b/dom/base/CharacterData.cpp
@@ -430,8 +430,8 @@ nsresult CharacterData::BindToTree(Document* aDocument, nsIContent* aParent,
     if (aParent->IsInNativeAnonymousSubtree()) {
       SetFlags(NODE_IS_IN_NATIVE_ANONYMOUS_SUBTREE);
     }
-    if (aParent->HasFlag(NODE_CHROME_ONLY_ACCESS)) {
-      SetFlags(NODE_CHROME_ONLY_ACCESS);
+    if (aParent->HasFlag(NODE_HAS_BEEN_IN_UA_WIDGET)) {
+      SetFlags(NODE_HAS_BEEN_IN_UA_WIDGET);
     }
     if (HasFlag(NODE_IS_ANONYMOUS_ROOT)) {
       aParent->SetMayHaveAnonymousChildren();
diff --git a/dom/base/Document.h b/dom/base/Document.h
index 8745b082530a..d00b16979c45 100644
--- a/dom/base/Document.h
+++ b/dom/base/Document.h
@@ -4780,7 +4780,7 @@ inline bool ShouldUseNACScope(const nsINode* aNode) {
 }
 
 inline bool ShouldUseUAWidgetScope(const nsINode* aNode) {
-  return aNode->IsInUAWidget();
+  return aNode->HasBeenInUAWidget();
 }
 
 inline mozilla::dom::ParentObject nsINode::GetParentObject() const {
diff --git a/dom/base/Element.cpp b/dom/base/Element.cpp
index b19067b10dd0..25f4e80e766e 100644
--- a/dom/base/Element.cpp
+++ b/dom/base/Element.cpp
@@ -1632,8 +1632,8 @@ nsresult Element::BindToTree(Document* aDocument, nsIContent* aParent,
     if (aParent->IsInNativeAnonymousSubtree()) {
       SetFlags(NODE_IS_IN_NATIVE_ANONYMOUS_SUBTREE);
     }
-    if (aParent->HasFlag(NODE_CHROME_ONLY_ACCESS)) {
-      SetFlags(NODE_CHROME_ONLY_ACCESS);
+    if (aParent->HasFlag(NODE_HAS_BEEN_IN_UA_WIDGET)) {
+      SetFlags(NODE_HAS_BEEN_IN_UA_WIDGET);
     }
     if (HasFlag(NODE_IS_ANONYMOUS_ROOT)) {
       aParent->SetMayHaveAnonymousChildren();
diff --git a/dom/base/ShadowRoot.cpp b/dom/base/ShadowRoot.cpp
index 8d74f5296d07..50216e83097b 100644
--- a/dom/base/ShadowRoot.cpp
+++ b/dom/base/ShadowRoot.cpp
@@ -592,7 +592,6 @@ nsINode* ShadowRoot::CreateElementAndAppendChildAt(nsINode& aParentNode,
                                                    const nsAString& aTagName,
                                                    mozilla::ErrorResult& rv) {
   MOZ_ASSERT(mIsUAWidget);
-  MOZ_ASSERT(OwnerDoc());
 
   if (!aParentNode.IsInUAWidget()) {
     rv.Throw(NS_ERROR_INVALID_ARG);
diff --git a/dom/base/ShadowRoot.h b/dom/base/ShadowRoot.h
index 93cd13881452..1ee2ef40e4b8 100644
--- a/dom/base/ShadowRoot.h
+++ b/dom/base/ShadowRoot.h
@@ -190,7 +190,7 @@ class ShadowRoot final : public DocumentFragment,
 
   void SetIsUAWidget() {
     MOZ_ASSERT(!HasChildren());
-    SetFlags(NODE_IS_ROOT_OF_CHROME_ONLY_ACCESS | NODE_CHROME_ONLY_ACCESS);
+    SetFlags(NODE_HAS_BEEN_IN_UA_WIDGET);
     mIsUAWidget = true;
   }
 
diff --git a/dom/base/nsIContentInlines.h b/dom/base/nsIContentInlines.h
index 026ba1c42433..9adc5c3f39cf 100644
--- a/dom/base/nsIContentInlines.h
+++ b/dom/base/nsIContentInlines.h
@@ -17,6 +17,23 @@
 #include "mozilla/dom/HTMLSlotElement.h"
 #include "mozilla/dom/ShadowRoot.h"
 
+inline bool nsINode::IsUAWidget() const {
+  auto* shadow = mozilla::dom::ShadowRoot::FromNode(this);
+  return shadow && shadow->IsUAWidget();
+}
+
+inline bool nsINode::IsInUAWidget() const {
+  if (!IsInShadowTree()) {
+    return false;
+  }
+  mozilla::dom::ShadowRoot* shadow = AsContent()->GetContainingShadow();
+  return shadow && shadow->IsUAWidget();
+}
+
+inline bool nsINode::IsRootOfChromeAccessOnlySubtree() const {
+  return IsRootOfNativeAnonymousSubtree() || IsUAWidget();
+}
+
 inline bool nsIContent::IsInHTMLDocument() const {
   return OwnerDoc()->IsHTMLDocument();
 }
diff --git a/dom/base/nsINode.cpp b/dom/base/nsINode.cpp
index 0db17da76fec..24bd5e0f4868 100644
--- a/dom/base/nsINode.cpp
+++ b/dom/base/nsINode.cpp
@@ -477,14 +477,6 @@ SVGUseElement* nsINode::DoGetContainingSVGUseShadowHost() const {
   return SVGUseElement::FromNodeOrNull(AsContent()->GetContainingShadowHost());
 }
 
-bool nsINode::IsInUAWidget() const {
-  if (!IsInShadowTree()) {
-    return false;
-  }
-  ShadowRoot* shadowRoot = AsContent()->GetContainingShadow();
-  return shadowRoot && shadowRoot->IsUAWidget();
-}
-
 void nsINode::GetNodeValueInternal(nsAString& aNodeValue) {
   SetDOMStringToNull(aNodeValue);
 }
diff --git a/dom/base/nsINode.h b/dom/base/nsINode.h
index 3b0c6334571b..3e036752df9e 100644
--- a/dom/base/nsINode.h
+++ b/dom/base/nsINode.h
@@ -183,12 +183,10 @@ enum {
 
   NODE_ALL_DIRECTION_FLAGS = NODE_HAS_DIRECTION_LTR | NODE_HAS_DIRECTION_RTL,
 
-  NODE_CHROME_ONLY_ACCESS = NODE_FLAG_BIT(18),
-
-  NODE_IS_ROOT_OF_CHROME_ONLY_ACCESS = NODE_FLAG_BIT(19),
+  NODE_HAS_BEEN_IN_UA_WIDGET = NODE_FLAG_BIT(18),
 
   // Remaining bits are node type specific.
-  NODE_TYPE_SPECIFIC_BITS_OFFSET = 20
+  NODE_TYPE_SPECIFIC_BITS_OFFSET = 19
 };
 
 // Make sure we have space for our bits
@@ -1073,7 +1071,7 @@ class nsINode : public mozilla::dom::EventTarget {
         !(aFlagsToSet &
           (NODE_IS_ANONYMOUS_ROOT | NODE_IS_NATIVE_ANONYMOUS_ROOT |
            NODE_IS_IN_NATIVE_ANONYMOUS_SUBTREE | NODE_DESCENDANTS_NEED_FRAMES |
-           NODE_NEEDS_FRAME | NODE_CHROME_ONLY_ACCESS)) ||
+           NODE_NEEDS_FRAME | NODE_HAS_BEEN_IN_UA_WIDGET)) ||
             IsContent(),
         "Flag only permitted on nsIContent nodes");
     nsWrapperCache::SetFlags(aFlagsToSet);
@@ -1081,7 +1079,7 @@ class nsINode : public mozilla::dom::EventTarget {
 
   void UnsetFlags(FlagsType aFlagsToUnset) {
     NS_ASSERTION(!(aFlagsToUnset & (NODE_IS_ANONYMOUS_ROOT |
-                                    NODE_IS_IN_NATIVE_ANONYMOUS_SUBTREE |
+                                    NODE_HAS_BEEN_IN_UA_WIDGET |
                                     NODE_IS_NATIVE_ANONYMOUS_ROOT)),
                  "Trying to unset write-only flags");
     nsWrapperCache::UnsetFlags(aFlagsToUnset);
@@ -1125,13 +1123,13 @@ class nsINode : public mozilla::dom::EventTarget {
     return DoGetContainingSVGUseShadowHost();
   }
 
-  bool IsInUAWidget() const;
+  // Whether this node has ever been part of a UA widget shadow tree.
+  bool HasBeenInUAWidget() const { return HasFlag(NODE_HAS_BEEN_IN_UA_WIDGET); }
 
-  // True for native anonymous content and for XBL content if the binding
-  // has chromeOnlyContent="true".
+  // True for native anonymous content and for content in UA widgets.
   bool ChromeOnlyAccess() const {
     return HasFlag(NODE_IS_IN_NATIVE_ANONYMOUS_SUBTREE |
-                   NODE_CHROME_ONLY_ACCESS);
+                   NODE_HAS_BEEN_IN_UA_WIDGET);
   }
 
   bool IsInShadowTree() const { return HasFlag(NODE_IS_IN_SHADOW_TREE); }
@@ -1149,10 +1147,12 @@ class nsINode : public mozilla::dom::EventTarget {
     return HasFlag(NODE_IS_NATIVE_ANONYMOUS_ROOT);
   }
 
-  bool IsRootOfChromeAccessOnlySubtree() const {
-    return HasFlag(NODE_IS_NATIVE_ANONYMOUS_ROOT |
-                   NODE_IS_ROOT_OF_CHROME_ONLY_ACCESS);
-  }
+  // Whether this node is a UA Widget ShadowRoot.
+  inline bool IsUAWidget() const;
+  // Whether this node is currently in a UA Widget Shadow tree.
+  inline bool IsInUAWidget() const;
+  // Whether this node is the root of a ChromeOnlyAccess DOM subtree.
+  inline bool IsRootOfChromeAccessOnlySubtree() const;
 
   /**
    * Returns true if |this| node is the common ancestor of the start/end