Match camelCased SVG attributes selectors in html documents.

third_party/WebKit/Source/core/css/SelectorChecker.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2004-2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Nicholas Shanks (webkit@nickshanks.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc.
  * All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
@@ skipping 541 matching lines @@
   element.synchronizeAttribute(selectorAttr.localName());
 
   const AtomicString& selectorValue = selector.value();
   TextCaseSensitivity caseSensitivity =
       (selector.attributeMatch() == CSSSelector::CaseInsensitive)
           ? TextCaseASCIIInsensitive
           : TextCaseSensitive;
 
   AttributeCollection attributes = element.attributesWithoutUpdate();
   for (const auto& attributeItem : attributes) {
-    if (!attributeItem.matches(selectorAttr))
-      continue;
+    if (!attributeItem.matches(selectorAttr)) {
+      if (element.isHTMLElement() || !element.document().isHTMLDocument())
+        continue;
+      // Non-html attributes in html documents are normalized to their camel-
+      // cased version during parsing if applicable. Yet, attribute selectors
+      // are lower-cased for selectors in html documents. Compare the selector
+      // and the attribute local name insensitively to e.g. allow matching SVG
+      // attributes like viewBox.
+      if (!attributeItem.matchesCaseInsensitive(selectorAttr))
+        continue;
+    }
 
     if (attributeValueMatches(attributeItem, match, selectorValue,
                               caseSensitivity))
       return true;
 
     if (caseSensitivity == TextCaseASCIIInsensitive) {
       if (selectorAttr.namespaceURI() != starAtom)
         return false;
       continue;
     }
@@ skipping 694 matching lines @@
 }
 
 bool SelectorChecker::matchesFocusPseudoClass(const Element& element) {
   if (InspectorInstrumentation::forcePseudoState(const_cast<Element*>(&element),
                                                  CSSSelector::PseudoFocus))
     return true;
   return element.isFocused() && isFrameFocused(element);
 }
 
 }  // namespace blink