Remove support for pseudo classes in <content select>.

Source/core/html/HTMLContentElement.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Neither the name of Google Inc. nor the names of its
@@ skipping 11 matching lines @@
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 #include "core/html/HTMLContentElement.h"
 
 #include "core/HTMLNames.h"
 #include "core/css/SelectorChecker.h"
-#include "core/css/SiblingTraversalStrategies.h"
 #include "core/css/parser/CSSParser.h"
 #include "core/dom/QualifiedName.h"
 #include "core/dom/shadow/ElementShadow.h"
 #include "core/dom/shadow/ShadowRoot.h"
 #include "platform/RuntimeEnabledFeatures.h"
 
 namespace blink {
 
 using namespace HTMLNames;
 
@@ skipping 51 matching lines @@
 bool HTMLContentElement::validateSelect() const
 {
     ASSERT(!m_shouldParseSelect);
 
     if (m_select.isNull() || m_select.isEmpty())
         return true;
 
     if (!m_selectorList.isValid())
         return false;
 
-    bool allowAnyPseudoClasses = RuntimeEnabledFeatures::pseudoClassesInMatchingCriteriaInAuthorShadowTreesEnabled() || (containingShadowRoot() && containingShadowRoot()->type() == ShadowRoot::UserAgentShadowRoot);
-
     for (const CSSSelector* selector = m_selectorList.first(); selector; selector = m_selectorList.next(*selector)) {
         if (!selector->isCompound())
             return false;
-        if (allowAnyPseudoClasses)
-            continue;
         for (const CSSSelector* subSelector = selector; subSelector; subSelector = subSelector->tagHistory()) {
             if (includesDisallowedPseudoClass(*subSelector))
                 return false;
         }
     }
     return true;
 }
 
-static inline bool checkOneSelector(const CSSSelector& selector, const WillBeHeapVector<RawPtrWillBeMember<Node>, 32>& siblings, int nth)
+// TODO(esprehn): element should really be const, but matching a selector is not
+// const for some SelectorCheckingModes (mainly ResolvingStyle) where it sets
+// dynamic restyle flags on elements.
+bool HTMLContentElement::matchSelector(Element& element) const
 {
-    Element* element = toElement(siblings[nth]);
     SelectorChecker selectorChecker(SelectorChecker::QueryingRules);
-    SelectorChecker::SelectorCheckingContext context(selector, element, SelectorChecker::VisitedMatchEnabled);
-    ShadowDOMSiblingTraversalStrategy strategy(siblings, nth);
-    return selectorChecker.match(context, strategy) == SelectorChecker::SelectorMatches;
-}
-
-bool HTMLContentElement::matchSelector(const WillBeHeapVector<RawPtrWillBeMember<Node>, 32>& siblings, int nth) const
-{
     for (const CSSSelector* selector = selectorList().first(); selector; selector = CSSSelectorList::next(*selector)) {
-        if (checkOneSelector(*selector, siblings, nth))
+        SelectorChecker::SelectorCheckingContext context(*selector, &element, SelectorChecker::VisitedMatchDisabled);

[esprehn, 2015/05/06 23:57:52]

I also switched this to VisitedMatchDisabled. Since pseudos were disabled for
non-UA code before and we never used them in UA code this was essentially
impossible, but now it really is impossible by forcing it off like
querySelector. Previously if the
pseudoClassesInMatchingCriteriaInAuthorShadowTrees flag was enabled we
accidentally allowed matching :visited which is a privacy leak.

+        if (selectorChecker.match(context) == SelectorChecker::SelectorMatches)
             return true;
     }
     return false;
 }
 
 }