Pseudo elements may only appear in rightmost compound.

third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSSelectorParser.h"
 
 #include "core/css/CSSSelectorList.h"
 #include "core/css/StyleSheetContents.h"
 #include "core/frame/UseCounter.h"
 #include "platform/RuntimeEnabledFeatures.h"
@@ skipping 112 matching lines @@
             return CSSSelectorList();
         selectorList.append(selector.release());
     }
 
     if (m_failedParsing)
         return CSSSelectorList();
 
     return CSSSelectorList::adoptSelectorVector(selectorList);
 }
 
+namespace {
+
+enum CompoundSelectorFlags {
+    HasPseudoElementForRightmostCompound = 1 << 1,

[Timothy Loh, 2016/01/19 04:59:27]

Shouldn't we start counting from 1 << 0?

[rune, 2016/01/19 08:41:51]

Done.

+    HasContentPseudoElement = 1 << 2
+};
+
+unsigned extractCompoundFlags(const CSSParserSelector& simpleSelector, CSSParserMode parserMode)
+{
+    if (simpleSelector.match() != CSSSelector::PseudoElement)
+        return 0;
+    if (simpleSelector.pseudoType() == CSSSelector::PseudoContent)
+        return HasContentPseudoElement;
+    if (simpleSelector.pseudoType() == CSSSelector::PseudoShadow)
+        return 0;
+    // TODO(rune@opera.com): crbug.com/578131
+    // The UASheetMode check is a work-around to allow this selector in mediaControls(New).css:
+    // input[type="range" i]::-webkit-media-slider-container > div {
+    if (parserMode == UASheetMode && simpleSelector.pseudoType() == CSSSelector::PseudoWebKitCustomElement)
+        return 0;
+    return HasPseudoElementForRightmostCompound;
+}
+
+} // namespace
+
 PassOwnPtr<CSSParserSelector> CSSSelectorParser::consumeComplexSelector(CSSParserTokenRange& range)
 {
     OwnPtr<CSSParserSelector> selector = consumeCompoundSelector(range);
     if (!selector)
         return nullptr;
 
-    bool previousCompoundHasContentPseudo = false;
 
-    for (CSSParserSelector* simple = selector.get(); simple && !previousCompoundHasContentPseudo; simple = simple->tagHistory())
-        previousCompoundHasContentPseudo = simple->pseudoType() == CSSSelector::PseudoContent;
+    unsigned previousCompoundFlags = 0;
+
+    for (CSSParserSelector* simple = selector.get(); simple && !previousCompoundFlags; simple = simple->tagHistory())
+        previousCompoundFlags |= extractCompoundFlags(*simple, m_context.mode());
 
     while (CSSSelector::Relation combinator = consumeCombinator(range)) {
         OwnPtr<CSSParserSelector> nextSelector = consumeCompoundSelector(range);
         if (!nextSelector)
             return combinator == CSSSelector::Descendant ? selector.release() : nullptr;
+        if (previousCompoundFlags & HasPseudoElementForRightmostCompound)
+            return nullptr;
         CSSParserSelector* end = nextSelector.get();
-        bool compoundHasContentPseudo = end->pseudoType() == CSSSelector::PseudoContent;
+        unsigned compoundFlags = extractCompoundFlags(*end, m_context.mode());
         while (end->tagHistory()) {
             end = end->tagHistory();
-            compoundHasContentPseudo |= end->pseudoType() == CSSSelector::PseudoContent;
+            compoundFlags |= extractCompoundFlags(*end, m_context.mode());
         }
         end->setRelation(combinator);
-        if (previousCompoundHasContentPseudo)
+        if (previousCompoundFlags & HasContentPseudoElement)
             end->setRelationIsAffectedByPseudoContent();
-        previousCompoundHasContentPseudo = compoundHasContentPseudo;
+        previousCompoundFlags = compoundFlags;
         end->setTagHistory(selector.release());
 
         selector = nextSelector.release();
     }
 
     return selector.release();
 }
 
 namespace {
 
@@ skipping 547 matching lines @@
 
     if (!splitAfter || !splitAfter->tagHistory())
         return compoundSelector;
 
     OwnPtr<CSSParserSelector> secondCompound = splitAfter->releaseTagHistory();
     secondCompound->appendTagHistory(CSSSelector::ShadowPseudo, compoundSelector);
     return secondCompound.release();
 }
 
 } // namespace blink