XPath sorting asserts on node-sets with nodes from different trees

commit message

XPath sorting asserts on node-sets with nodes from different trees
https://bugs.webkit.org/show_bug.cgi?id=330124
rdar://191814002

Reviewed by Ryosuke Niwa.

NodeSet::sort() now sorts the nodes of each tree separately and keeps the
trees in first-seen order. Since 17129@main it assumed a single tree, so a
union of a document node with a detached attribute or disconnected node,
such as (id("x") | .), crashed or read out of bounds. Large node-sets in a
shadow tree are now sorted from the shadow root; since 91446@main they
were sorted from the document, which never reaches them.

The test gains a shadow tree subtest and checks the order within a tree.
It is skipped in debug builds, where each id lookup checks the whole id
map's consistency, which makes its 10005 lookups time out.

Canonical link: https://commits.webkit.org/325918@main

this commit matched a vulnerability pattern in its message. WebKit does not publish a security bug for every fix, so treat it as a lead, not as a CVE record.