Regression(r164102): CSS Selector queries on duplicate ids match non-descendant elements

Source/core/dom/SelectorQuery.cpp

 /*
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 319 matching lines @@
 
     // Fast path for querySelectorAll('#id'), querySelectorAll('tag#id').
     if (const CSSSelector* idSelector = selectorForIdLookup(firstSelector)) {
         const AtomicString& idToMatch = idSelector->value();
         if (rootNode.treeScope().containsMultipleElementsWithId(idToMatch)) {
             const Vector<Element*>& elements = rootNode.treeScope().getAllElementsById(idToMatch);
             size_t count = elements.size();
             for (size_t i = 0; i < count; ++i) {
                 Element* element = elements[i];
                 ASSERT(element);
+                if (!(isTreeScopeRoot(rootNode) || element->isDescendantOf(&rootNode)))
+                    continue;
                 if (selectorMatches(selector, *element, rootNode))
                     matchedElements.append(element);
             }
             return;
         }
         Element* element = rootNode.treeScope().getElementById(idToMatch);
         if (!element || !(isTreeScopeRoot(rootNode) || element->isDescendantOf(&rootNode)))
             return;
         if (selectorMatches(selector, *element, rootNode))
             matchedElements.append(element);
@@ skipping 106 matching lines @@
 
     // Fast path for querySelectorAll('#id'), querySelectorAll('tag#id').
     if (const CSSSelector* idSelector = selectorForIdLookup(firstSelector)) {
         const AtomicString& idToMatch = idSelector->value();
         if (rootNode.treeScope().containsMultipleElementsWithId(idToMatch)) {
             const Vector<Element*>& elements = rootNode.treeScope().getAllElementsById(idToMatch);
             size_t count = elements.size();
             for (size_t i = 0; i < count; ++i) {
                 Element* element = elements[i];
                 ASSERT(element);
+                if (!(isTreeScopeRoot(rootNode) || element->isDescendantOf(&rootNode)))

[Inactive, 2014/01/05 20:46:33]

FYI, I am planning on working on getting rid of the code duplication between
executeQueryFirst() / executeQueryAll() in a follow-up patch.

+                    continue;
                 if (selectorMatches(selector, *element, rootNode))
                     return element;
             }
             return 0;
         }
         Element* element = rootNode.treeScope().getElementById(idToMatch);
         if (!element || !(isTreeScopeRoot(rootNode) || element->isDescendantOf(&rootNode)))
             return 0;
         return selectorMatches(selector, *element, rootNode) ? element : 0;
     }
@@ skipping 79 matching lines @@
     m_entries.add(selectors, selectorQuery.release());
     return rawSelectorQuery;
 }
 
 void SelectorQueryCache::invalidate()
 {
     m_entries.clear();
 }
 
 }