document.querySelector[All]() should check selector context

Source/core/css/SelectorChecker.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2004-2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Nicholas Shanks (webkit@nickshanks.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (c) 2011, Code Aurora Forum. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
@@ skipping 942 matching lines @@
         if (m_mode == ResolvingStyle)
             element.document().setContainsValidityStyleRules();
         return element.isOutOfRange();
     case CSSSelector::PseudoFutureCue:
         return element.isVTTElement() && !toVTTElement(element).isPastNode();
     case CSSSelector::PseudoPastCue:
         return element.isVTTElement() && toVTTElement(element).isPastNode();
     case CSSSelector::PseudoScope:
         if (m_mode == SharingRules)
             return true;
-        if (context.scope)
-            return context.scope == element;
-        return element == element.document().documentElement();
+        if (context.scope == element.document())
+            return element == element.document().documentElement();
+        return context.scope == element;
     case CSSSelector::PseudoUnresolved:
         return element.isUnresolvedCustomElement();
     case CSSSelector::PseudoHost:
     case CSSSelector::PseudoHostContext:
         return checkPseudoHost(context, result);
     case CSSSelector::PseudoSpatialNavigationFocus:
         return context.isUARule && matchesSpatialNavigationFocusPseudoClass(element);
     case CSSSelector::PseudoListBox:
         return context.isUARule && matchesListBoxPseudoClass(element);
     case CSSSelector::PseudoWindowInactive:
@@ skipping 67 matching lines @@
 }
 
 bool SelectorChecker::checkPseudoHost(const SelectorCheckingContext& context, MatchResult& result) const
 {
     const CSSSelector& selector = *context.selector;
     Element& element = *context.element;
 
     if (m_mode == SharingRules)
         return true;
     // :host only matches a shadow host when :host is in a shadow tree of the shadow host.
-    if (!context.scope)
-        return false;
     const ContainerNode* shadowHost = context.scope->shadowHost();
     if (!shadowHost || shadowHost != element)
         return false;
     ASSERT(element.shadow());
 
     // For empty parameter case, i.e. just :host or :host().
     if (!selector.selectorList()) // Use *'s specificity. So just 0.
         return true;
 
     SelectorCheckingContext subContext(context);
@@ skipping 123 matching lines @@
 }
 
 bool SelectorChecker::matchesFocusPseudoClass(const Element& element)
 {
     if (InspectorInstrumentation::forcePseudoState(const_cast<Element*>(&element), CSSSelector::PseudoFocus))
         return true;
     return element.focused() && isFrameFocused(element);
 }
 
 }