XPath: Fix context node of rhs of union operator

https://bugs.webkit.org/show_bug.cgi?id=256770

Reviewed by Alexey Proskuryakov.

Use the right context node for rhs of union operator. This aligns our behavior
with Firefox and Chrome.

This is a cherry-pick of the following Blink commit:
- https://chromium-review.googlesource.com/c/chromium/src/+/1973333

* LayoutTests/imported/w3c/web-platform-tests/domxpath/node-sets-expected.txt:
* Source/WebCore/xml/XPathPredicate.cpp:
(WebCore::XPath::Union::evaluate const):

Canonical link: https://commits.webkit.org/264097@main

LayoutTests/imported/w3c/web-platform-tests/domxpath/node-sets-expected.txt

@@ -1,3 +1,3 @@
 
-FAIL | operator should evaluate both sides of expressions with the same context node assert_equals: expected 2 but got 1
+PASS | operator should evaluate both sides of expressions with the same context node
 

Source/WebCore/xml/XPathPredicate.cpp

@@ -252,11 +252,16 @@ Union::Union(std::unique_ptr<Expression> lhs, std::unique_ptr<Expression> rhs)
 
 Value Union::evaluate() const
 {
+    EvaluationContext clonedContext(Expression::evaluationContext());
     Value lhsResult = subexpression(0).evaluate();
-    Value rhs = subexpression(1).evaluate();
+    Value rhsResult = [&] {
+        SetForScope<EvaluationContext> contextForScope(Expression::evaluationContext(), clonedContext);
+        return subexpression(1).evaluate();
+    }();
+    Expression::evaluationContext().hadTypeConversionError |= clonedContext.hadTypeConversionError;
 
     NodeSet& resultSet = lhsResult.modifiableNodeSet();
-    const NodeSet& rhsNodes = rhs.toNodeSet();
+    const NodeSet& rhsNodes = rhsResult.toNodeSet();
 
     HashSet<RefPtr<Node>> nodes;
     for (auto& result : resultSet)