querySelector* fast-path missing namespace check for no namespace.

third_party/WebKit/Source/core/dom/SelectorQuery.cpp

 /*
  * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2014 Samsung Electronics. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 187 matching lines @@
     // for selectors in html documents. Compare the upper case converted names
     // instead to allow matching SVG elements like foreignObject.
     if (!element.isHTMLElement() && element.document().isHTMLDocument())
         return element.tagQName().localNameUpper() == tagName.localNameUpper();
     return false;
 }
 
 template <typename SelectorQueryTrait>
 void SelectorDataList::collectElementsByTagName(ContainerNode& rootNode, const QualifiedName& tagName,  typename SelectorQueryTrait::OutputType& output) const
 {
+    DCHECK_EQ(tagName.namespaceURI(), starAtom);
     for (Element& element : ElementTraversal::descendantsOf(rootNode)) {
-        // querySelector*() doesn't allow namespaces and throws before it gets
-        // here so we can ignore them.
-        DCHECK_EQ(tagName.namespaceURI(), starAtom);
         if (matchesTagName(tagName, element)) {
             SelectorQueryTrait::appendElement(output, element);
             if (SelectorQueryTrait::shouldOnlyMatchFirstElement)
                 return;
         }
     }
 }
 
 inline bool SelectorDataList::canUseFastQuery(const ContainerNode& rootNode) const
 {
@@ skipping 281 matching lines @@
         return;
     }
 
     if (!firstSelector.tagHistory()) {
         // Fast path for querySelector*('.foo'), and querySelector*('div').
         switch (firstSelector.match()) {
         case CSSSelector::Class:
             collectElementsByClassName<SelectorQueryTrait>(rootNode, firstSelector.value(), output);
             return;
         case CSSSelector::Tag:
-            collectElementsByTagName<SelectorQueryTrait>(rootNode, firstSelector.tagQName(), output);
-            return;
+            if (firstSelector.tagQName().namespaceURI() == starAtom) {
+                collectElementsByTagName<SelectorQueryTrait>(rootNode, firstSelector.tagQName(), output);
+                return;
+            }
+            // querySelector*() doesn't allow namespace prefix resolution and
+            // throws before we get here, but we still may have selectors for
+            // elements without a namespace.
+            DCHECK_EQ(firstSelector.tagQName().namespaceURI(), nullAtom);
+            break;
         default:
             break; // If we need another fast path, add here.
         }
     }
 
     findTraverseRootsAndExecute<SelectorQueryTrait>(rootNode, output);
 }
 
 PassOwnPtr<SelectorQuery> SelectorQuery::adopt(CSSSelectorList selectorList)
 {
@@ skipping 45 matching lines @@
 
     return m_entries.add(selectors, SelectorQuery::adopt(std::move(selectorList))).storedValue->value.get();
 }
 
 void SelectorQueryCache::invalidate()
 {
     m_entries.clear();
 }
 
 } // namespace blink