Setting selectorText of PageRule accepts invalid selectors

third_party/WebKit/Source/core/css/parser/CSSParser.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSParser.h"
 
 #include "core/css/CSSColorValue.h"
 #include "core/css/CSSKeyframeRule.h"
 #include "core/css/StyleColor.h"
 #include "core/css/StylePropertySet.h"
@@ skipping 19 matching lines @@
 {
     CSSParserImpl::parseDeclarationListForInspector(declaration, context, observer);
 }
 
 CSSSelectorList CSSParser::parseSelector(const CSSParserContext& context, StyleSheetContents* styleSheetContents, const String& selector)
 {
     CSSTokenizer::Scope scope(selector);
     return CSSSelectorParser::parseSelector(scope.tokenRange(), context, styleSheetContents);
 }
 
+CSSSelectorList CSSParser::parsePageSelector(const CSSParserContext& context, StyleSheetContents* styleSheetContents, const String& selector)
+{
+    CSSTokenizer::Scope scope(selector);
+    CSSParserTokenRange range = scope.tokenRange();
+    const CSSParserToken* preludeStart = &range.peek();
+    while (!range.atEnd() && range.peek().type() != LeftBraceToken && range.peek().type() != SemicolonToken)

[Timothy Loh, 2016/02/01 21:55:15]

Seems wrong, if you specify ":left { bla" as a page selector it should be
invalid (I assume regular selectors don't allow this sort of stuff either).

[ramya.v, 2016/02/02 05:43:24]

In the existing implementation ":left { bla" is parsed as ":left {}" (empty
declaration block instead of completely invalidating the selector). 

[Timothy Loh, 2016/02/02 05:49:12]

Yes, but this function only concerns itself with parsing an @page selector, not
an @page rule.

For a style rule we don't allow this sort of thing:

<style> div { } </style>
<script>
var rule = document.styleSheets[0].cssRules[0];
console.log(rule.selectorText) // "div"
rule.selectorText = "span { bla"
console.log(rule.selectorText) // still "div"
</script>

[ramya.v, 2016/02/02 06:40:17]

Got your point. Thanks :) 
Done in https://codereview.chromium.org/1661453002/

+        range.consumeComponentValue();
+    return CSSParserImpl::parsePageSelector(range.makeSubRange(preludeStart, &range.peek()), styleSheetContents);
+}
+
 PassRefPtrWillBeRawPtr<StyleRuleBase> CSSParser::parseRule(const CSSParserContext& context, StyleSheetContents* styleSheet, const String& rule)
 {
     return CSSParserImpl::parseRule(rule, context, styleSheet, CSSParserImpl::AllowImportRules);
 }
 
 void CSSParser::parseSheet(const CSSParserContext& context, StyleSheetContents* styleSheet, const String& text)
 {
     return CSSParserImpl::parseStyleSheet(text, context, styleSheet);
 }
 
@@ skipping 117 matching lines @@
     builder.appendLiteral(" : ");
     builder.append(propertyValue);
     builder.appendLiteral("; }");
     RefPtrWillBeRawPtr<StyleRuleBase> rule = parseRule(context, nullptr, builder.toString());
     if (!rule || !rule->isFontFaceRule())
         return nullptr;
     return toStyleRuleFontFace(rule.get())->properties().getPropertyCSSValue(propertyID);
 }
 
 } // namespace blink