XPath: Fix context node after evaluating an expression in a predicate

The new behavior matches to Edge and Firefox.

Bug: 625710
Change-Id: I27de8b769712062f548eb9d2274544d1ec0ff073
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1973435
Commit-Queue: Kent Tamura <tkent@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Cr-Commit-Position: refs/heads/master@{#726221}
diff --git a/domxpath/predicates.html b/domxpath/predicates.html
new file mode 100644
index 0000000..1786740
--- /dev/null
+++ b/domxpath/predicates.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<link rel="help" href="https://www.w3.org/TR/1999/REC-xpath-19991116/#predicates">
+<body>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+function nodesetToSet(result) {
+  const set = new Set();
+  for (let node = result.iterateNext(); node; node = result.iterateNext()) {
+    set.add(node);
+  }
+  return set;
+}
+
+test(() => {
+  const doc = document.implementation.createHTMLDocument();
+  doc.body.innerHTML = '<table></table>' +
+    '<table><tr><th><th><th><th></table>' +
+    '<table></table>';
+  const result = nodesetToSet(doc.evaluate('(//table)[count((//table)[2]/descendant::th)-1]', doc.documentElement));
+  assert_equals(result.size, 1);
+  assert_true(result.has(doc.body.lastChild));
+}, 'An expression in a predicate should not change the context node');
+</script>
+</body>