Introduce Node::containingTreeScope(), which asserts that the node's root is a tree scope

third_party/WebKit/Source/core/dom/SelectorQuery.cpp

Index: third_party/WebKit/Source/core/dom/SelectorQuery.cpp
diff --git a/third_party/WebKit/Source/core/dom/SelectorQuery.cpp b/third_party/WebKit/Source/core/dom/SelectorQuery.cpp
index 52d3fdb35f245d0efa6996c191c4f893c12b6914..0335588ad655fb49ccb8cbd411e0d799d90ce268 100644
--- a/third_party/WebKit/Source/core/dom/SelectorQuery.cpp
+++ b/third_party/WebKit/Source/core/dom/SelectorQuery.cpp
@@ -261,8 +261,8 @@ void SelectorDataList::findTraverseRootsAndExecute(ContainerNode& rootNode, type
     bool startFromParent = false;
 
     for (const CSSSelector* selector = m_selectors[0]; selector; selector = selector->tagHistory()) {
-        if (selector->match() == CSSSelector::Id && !rootNode.document().containsMultipleElementsWithId(selector->value())) {

[hayato, 2016/04/14 07:29:58]

Using document() here looks a bug to me.

[rune, 2016/04/14 08:48:01]

Yes. Perhaps fix that in a separate CL.

Reported https://crbug.com/603431

-            Element* element = rootNode.treeScope().getElementById(selector->value());
+        if (selector->match() == CSSSelector::Id && rootNode.isInTreeScope() && !rootNode.rootTreeScope().containsMultipleElementsWithId(selector->value())) {
+            Element* element = rootNode.rootTreeScope().getElementById(selector->value());
             ContainerNode* adjustedNode = &rootNode;
             if (element && (isTreeScopeRoot(rootNode) || element->isDescendantOf(&rootNode)))
                 adjustedNode = element;