Pseudo element selectors in compound selector lists are invalid.

third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSSelectorParser.h"
 
 #include "core/css/CSSSelectorList.h"
 #include "core/css/StyleSheetContents.h"
 #include "core/frame/UseCounter.h"
 #include "platform/RuntimeEnabledFeatures.h"
@@ skipping 60 matching lines @@
     range.consumeWhitespace();
     CSSSelectorList result = parser.consumeComplexSelectorList(range);
     if (!range.atEnd())
         return CSSSelectorList();
 
     recordSelectorStats(context, result);
     return result;
 }
 
 CSSSelectorParser::CSSSelectorParser(const CSSParserContext& context, StyleSheetContents* styleSheet)
-: m_context(context)
-, m_styleSheet(styleSheet)
-, m_failedParsing(false)
+    : m_context(context)
+    , m_styleSheet(styleSheet)
 {
 }
 
 CSSSelectorList CSSSelectorParser::consumeComplexSelectorList(CSSParserTokenRange& range)
 {
     Vector<OwnPtr<CSSParserSelector>> selectorList;
     OwnPtr<CSSParserSelector> selector = consumeComplexSelector(range);
     if (!selector)
         return CSSSelectorList();
     selectorList.append(selector.release());
@@ skipping 233 matching lines @@
     if (token.type() != IdentToken && token.type() != FunctionToken)
         return nullptr;
 
     OwnPtr<CSSParserSelector> selector = CSSParserSelector::create();
     selector->setMatch(colons == 1 ? CSSSelector::PseudoClass : CSSSelector::PseudoElement);
 
     String value = token.value();
     bool hasArguments = token.type() == FunctionToken;
     selector->updatePseudoType(AtomicString(value.is8Bit() ? value.lower() : value), hasArguments);
 
+    if (selector->match() == CSSSelector::PseudoElement && m_disallowPseudoElements)
+        return nullptr;
+
     if (token.type() == IdentToken) {
         range.consume();
         if (selector->pseudoType() == CSSSelector::PseudoUnknown)
             return nullptr;
         return selector.release();
     }
 
     CSSParserTokenRange block = range.consumeBlock();
     block.consumeWhitespace();
     if (selector->pseudoType() == CSSSelector::PseudoUnknown)
         return nullptr;
 
     switch (selector->pseudoType()) {
     case CSSSelector::PseudoHost:
     case CSSSelector::PseudoHostContext:
     case CSSSelector::PseudoAny:
     case CSSSelector::PseudoCue:
         {
+            DisallowPseudoElementsScope scope(this);
+
             OwnPtr<CSSSelectorList> selectorList = adoptPtr(new CSSSelectorList());
             *selectorList = consumeCompoundSelectorList(block);
             if (!selectorList->isValid() || !block.atEnd())
                 return nullptr;
             selector->setSelectorList(selectorList.release());
             return selector.release();
         }
     case CSSSelector::PseudoNot:
         {
             OwnPtr<CSSParserSelector> innerSelector = consumeCompoundSelector(block);
@@ skipping 309 matching lines @@
         compoundSelector->insertTagHistory(CSSSelector::SubSelector, simpleSelector, relation);
         return compoundSelector;
     }
 
     // All other simple selectors are added to the end of the compound.
     compoundSelector->appendTagHistory(CSSSelector::SubSelector, simpleSelector);
     return compoundSelector;
 }
 
 } // namespace blink