Fix selector namespace prefix resolution.

third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSSelectorParser.h"
 
 #include "core/css/CSSSelectorList.h"
 #include "core/css/StyleSheetContents.h"
 #include "core/frame/UseCounter.h"
 #include "platform/RuntimeEnabledFeatures.h"
@@ skipping 286 matching lines @@
             compoundPseudoElement = simpleSelector->pseudoType();
 
         if (compoundSelector)
             compoundSelector = addSimpleSelectorToCompound(compoundSelector.release(), simpleSelector.release());
         else
             compoundSelector = simpleSelector.release();
     }
 
     if (!compoundSelector) {
         AtomicString namespaceURI = determineNamespace(namespacePrefix);
-        if (namespaceURI.isNull())
+        if (namespaceURI.isNull()) {
+            m_failedParsing = true;

[rune, 2016/01/22 11:50:30]

There's a separate CL (https://codereview.chromium.org/1625433002/) for this,
but I needed the fix to not have regressions in the exception throwing for
querySelector and friends.

             return nullptr;
+        }
         return CSSParserSelector::create(QualifiedName(namespacePrefix, elementName, namespaceURI));
     }
     prependTypeSelectorIfNeeded(namespacePrefix, elementName, compoundSelector.get());
     return splitCompoundAtImplicitShadowCrossingCombinator(compoundSelector.release());
 }
 
 PassOwnPtr<CSSParserSelector> CSSSelectorParser::consumeSimpleSelector(CSSParserTokenRange& range)
 {
     const CSSParserToken& token = range.peek();
     OwnPtr<CSSParserSelector> selector;
@@ skipping 375 matching lines @@
 
 const AtomicString& CSSSelectorParser::defaultNamespace() const
 {
     if (!m_styleSheet)
         return starAtom;
     return m_styleSheet->defaultNamespace();
 }
 
 const AtomicString& CSSSelectorParser::determineNamespace(const AtomicString& prefix)
 {
+    if (prefix.isNull())
+        return defaultNamespace();
+    if (prefix.isEmpty())
+        return emptyAtom; // No namespace. If an element/attribute has a namespace, we won't match it.
+    if (prefix == starAtom)
+        return starAtom; // We'll match any namespace.
     if (!m_styleSheet)
-        return defaultNamespace();
-    return m_styleSheet->determineNamespace(prefix);
+        return nullAtom; // Cannot resolve prefix to namespace without a stylesheet, syntax error.
+    return m_styleSheet->namespaceURIFromPrefix(prefix);
 }
 
 void CSSSelectorParser::prependTypeSelectorIfNeeded(const AtomicString& namespacePrefix, const AtomicString& elementName, CSSParserSelector* compoundSelector)
 {
     if (elementName.isNull() && defaultNamespace() == starAtom && !compoundSelector->needsImplicitShadowCombinatorForMatching())
         return;
 
     AtomicString determinedElementName = elementName.isNull() ? starAtom : elementName;
     AtomicString namespaceURI = determineNamespace(namespacePrefix);
     if (namespaceURI.isNull()) {
@@ skipping 46 matching lines @@
 
     if (!splitAfter || !splitAfter->tagHistory())
         return compoundSelector;
 
     OwnPtr<CSSParserSelector> secondCompound = splitAfter->releaseTagHistory();
     secondCompound->appendTagHistory(secondCompound->pseudoType() == CSSSelector::PseudoSlotted ? CSSSelector::ShadowSlot : CSSSelector::ShadowPseudo, compoundSelector);
     return secondCompound.release();
 }
 
 } // namespace blink