Introduce Node::containingTreeScope(), which asserts that the node's root is a tree scope

third_party/WebKit/Source/core/dom/SelectorQuery.cpp

 /*
  * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2014 Samsung Electronics. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 243 matching lines @@
 void SelectorDataList::findTraverseRootsAndExecute(ContainerNode& rootNode, typename SelectorQueryTrait::OutputType& output) const
 {
     // We need to return the matches in document order. To use id lookup while there is possiblity of multiple matches
     // we would need to sort the results. For now, just traverse the document in that case.
     DCHECK_EQ(m_selectors.size(), 1u);
 
     bool isRightmostSelector = true;
     bool startFromParent = false;
 
     for (const CSSSelector* selector = m_selectors[0]; selector; selector = selector->tagHistory()) {
-        if (selector->match() == CSSSelector::Id && !rootNode.document().containsMultipleElementsWithId(selector->value())) {

[hayato, 2016/04/14 07:29:58]

Using document() here looks a bug to me.

[rune, 2016/04/14 08:48:01]

Yes. Perhaps fix that in a separate CL.

Reported https://crbug.com/603431

-            Element* element = rootNode.treeScope().getElementById(selector->value());
+        if (selector->match() == CSSSelector::Id && rootNode.isInTreeScope() && !rootNode.rootTreeScope().containsMultipleElementsWithId(selector->value())) {
+            Element* element = rootNode.rootTreeScope().getElementById(selector->value());
             ContainerNode* adjustedNode = &rootNode;
             if (element && (isTreeScopeRoot(rootNode) || element->isDescendantOf(&rootNode)))
                 adjustedNode = element;
             else if (!element || isRightmostSelector)
                 adjustedNode = nullptr;
             if (isRightmostSelector) {
                 executeForTraverseRoot<SelectorQueryTrait>(*m_selectors[0], adjustedNode, MatchesTraverseRoots, rootNode, output);
                 return;
             }
 
@@ skipping 294 matching lines @@
 
     return m_entries.add(selectors, SelectorQuery::adopt(std::move(selectorList))).storedValue->value.get();
 }
 
 void SelectorQueryCache::invalidate()
 {
     m_entries.clear();
 }
 
 } // namespace blink