Modify HTMLLabelElement::control to check if label is in tree scope

third_party/WebKit/Source/core/html/HTMLLabelElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2010 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 51 matching lines @@
         if (!element.isFormControlElement())
           UseCounter::count(
               document(),
               UseCounter::HTMLLabelElementControlForNonFormAssociatedElement);
         return &element;
       }
     }
     return nullptr;
   }
 
+  if (!isInTreeScope())
+    return nullptr;
+
   if (Element* element = treeScope().getElementById(controlId)) {
     if (isLabelableElement(*element) &&
         toLabelableElement(*element).supportLabels()) {
       if (!element->isFormControlElement())
         UseCounter::count(
             document(),
             UseCounter::HTMLLabelElementControlForNonFormAssociatedElement);
       return toLabelableElement(element);
     }
   }
@@ skipping 143 matching lines @@
 }
 
 void HTMLLabelElement::accessKeyAction(bool sendMouseEvents) {
   if (HTMLElement* element = control())
     element->accessKeyAction(sendMouseEvents);
   else
     HTMLElement::accessKeyAction(sendMouseEvents);
 }
 
 }  // namespace blink