Pseudo element selectors in compound selector lists are invalid.

third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSSelectorParser.h"
 
 #include "core/css/CSSSelectorList.h"
 #include "core/css/StyleSheetContents.h"
 #include "core/frame/UseCounter.h"
 #include "platform/RuntimeEnabledFeatures.h"
@@ skipping 60 matching lines @@
     range.consumeWhitespace();
     CSSSelectorList result = parser.consumeComplexSelectorList(range);
     if (!range.atEnd())
         return CSSSelectorList();
 
     recordSelectorStats(context, result);
     return result;
 }
 
 CSSSelectorParser::CSSSelectorParser(const CSSParserContext& context, StyleSheetContents* styleSheet)
-: m_context(context)
-, m_styleSheet(styleSheet)
-, m_failedParsing(false)
+    : m_context(context)
+    , m_styleSheet(styleSheet)
 {
 }
 
 CSSSelectorList CSSSelectorParser::consumeComplexSelectorList(CSSParserTokenRange& range)
 {
     Vector<OwnPtr<CSSParserSelector>> selectorList;
     OwnPtr<CSSParserSelector> selector = consumeComplexSelector(range);
     if (!selector)
         return CSSSelectorList();
     selectorList.append(selector.release());
     while (!range.atEnd() && range.peek().type() == CommaToken) {
         range.consumeIncludingWhitespace();
         selector = consumeComplexSelector(range);
         if (!selector)
             return CSSSelectorList();
         selectorList.append(selector.release());
     }
 
     if (m_failedParsing)
         return CSSSelectorList();
 
     return CSSSelectorList::adoptSelectorVector(selectorList);
 }
 
 CSSSelectorList CSSSelectorParser::consumeCompoundSelectorList(CSSParserTokenRange& range)
 {
+    DisallowPseudoElementsScope scope(this);

[Timothy Loh, 2016/01/11 05:20:54]

I think it would make more sense for this to be at the call-sites to this
function.

[rune, 2016/01/11 09:30:22]

Done.

+
     Vector<OwnPtr<CSSParserSelector>> selectorList;
     OwnPtr<CSSParserSelector> selector = consumeCompoundSelector(range);
     range.consumeWhitespace();
     if (!selector)
         return CSSSelectorList();
     selectorList.append(selector.release());
     while (!range.atEnd() && range.peek().type() == CommaToken) {
         // FIXME: This differs from the spec grammar:
         // Spec: compound_selector S* [ COMMA S* compound_selector ]* S*
         // Impl: compound_selector S* [ COMMA S* compound_selector S* ]*
@@ skipping 207 matching lines @@
     if (token.type() != IdentToken && token.type() != FunctionToken)
         return nullptr;
 
     OwnPtr<CSSParserSelector> selector = CSSParserSelector::create();
     selector->setMatch(colons == 1 ? CSSSelector::PseudoClass : CSSSelector::PseudoElement);
 
     String value = token.value();
     bool hasArguments = token.type() == FunctionToken;
     selector->updatePseudoType(AtomicString(value.is8Bit() ? value.lower() : value), hasArguments);
 
+    if (selector->match() == CSSSelector::PseudoElement && m_disallowPseudoElements)
+        return nullptr;
+
     if (token.type() == IdentToken) {
         range.consume();
         if (selector->pseudoType() == CSSSelector::PseudoUnknown)
             return nullptr;
         return selector.release();
     }
 
     CSSParserTokenRange block = range.consumeBlock();
     block.consumeWhitespace();
     if (selector->pseudoType() == CSSSelector::PseudoUnknown)
@@ skipping 327 matching lines @@
         compoundSelector->insertTagHistory(CSSSelector::SubSelector, simpleSelector, relation);
         return compoundSelector;
     }
 
     // All other simple selectors are added to the end of the compound.
     compoundSelector->appendTagHistory(CSSSelector::SubSelector, simpleSelector);
     return compoundSelector;
 }
 
 } // namespace blink