Pseudo element selectors in compound selector lists are invalid.

third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp

Index: third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp
diff --git a/third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp b/third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp
index bfd0f9fab4f5a90fbc5758c04248954b227fa73a..8ffd504ca1e698f04ba91f184d4ada837d2f2d33 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp
@@ -78,9 +78,8 @@ CSSSelectorList CSSSelectorParser::parseSelector(CSSParserTokenRange range, cons
 }
 
 CSSSelectorParser::CSSSelectorParser(const CSSParserContext& context, StyleSheetContents* styleSheet)
-: m_context(context)
-, m_styleSheet(styleSheet)
-, m_failedParsing(false)
+    : m_context(context)
+    , m_styleSheet(styleSheet)
 {
 }
 
@@ -334,6 +333,9 @@ PassOwnPtr<CSSParserSelector> CSSSelectorParser::consumePseudo(CSSParserTokenRan
     bool hasArguments = token.type() == FunctionToken;
     selector->updatePseudoType(AtomicString(value.is8Bit() ? value.lower() : value), hasArguments);
 
+    if (selector->match() == CSSSelector::PseudoElement && m_disallowPseudoElements)
+        return nullptr;
+
     if (token.type() == IdentToken) {
         range.consume();
         if (selector->pseudoType() == CSSSelector::PseudoUnknown)
@@ -352,6 +354,8 @@ PassOwnPtr<CSSParserSelector> CSSSelectorParser::consumePseudo(CSSParserTokenRan
     case CSSSelector::PseudoAny:
     case CSSSelector::PseudoCue:
         {
+            DisallowPseudoElementsScope scope(this);
+
             OwnPtr<CSSSelectorList> selectorList = adoptPtr(new CSSSelectorList());
             *selectorList = consumeCompoundSelectorList(block);
             if (!selectorList->isValid() || !block.atEnd())