Setting selectorText of PageRule accepts invalid selectors

third_party/WebKit/Source/core/css/parser/CSSParser.cpp

Index: third_party/WebKit/Source/core/css/parser/CSSParser.cpp
diff --git a/third_party/WebKit/Source/core/css/parser/CSSParser.cpp b/third_party/WebKit/Source/core/css/parser/CSSParser.cpp
index 85f65f96bbb96e5520c57eb9eccf4203051cb285..2c92c9655cfced9be696aeeb8beb8fe40ea68f1c 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSParser.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSParser.cpp
@@ -37,6 +37,16 @@ CSSSelectorList CSSParser::parseSelector(const CSSParserContext& context, StyleS
     return CSSSelectorParser::parseSelector(scope.tokenRange(), context, styleSheetContents);
 }
 
+CSSSelectorList CSSParser::parsePageSelector(const CSSParserContext& context, StyleSheetContents* styleSheetContents, const String& selector)
+{
+    CSSTokenizer::Scope scope(selector);
+    CSSParserTokenRange range = scope.tokenRange();
+    const CSSParserToken* preludeStart = &range.peek();
+    while (!range.atEnd() && range.peek().type() != LeftBraceToken && range.peek().type() != SemicolonToken)

[Timothy Loh, 2016/02/01 21:55:15]

Seems wrong, if you specify ":left { bla" as a page selector it should be
invalid (I assume regular selectors don't allow this sort of stuff either).

[ramya.v, 2016/02/02 05:43:24]

In the existing implementation ":left { bla" is parsed as ":left {}" (empty
declaration block instead of completely invalidating the selector). 

[Timothy Loh, 2016/02/02 05:49:12]

Yes, but this function only concerns itself with parsing an @page selector, not
an @page rule.

For a style rule we don't allow this sort of thing:

<style> div { } </style>
<script>
var rule = document.styleSheets[0].cssRules[0];
console.log(rule.selectorText) // "div"
rule.selectorText = "span { bla"
console.log(rule.selectorText) // still "div"
</script>

[ramya.v, 2016/02/02 06:40:17]

Got your point. Thanks :) 
Done in https://codereview.chromium.org/1661453002/

+        range.consumeComponentValue();
+    return CSSParserImpl::parsePageSelector(range.makeSubRange(preludeStart, &range.peek()), styleSheetContents);
+}
+
 PassRefPtrWillBeRawPtr<StyleRuleBase> CSSParser::parseRule(const CSSParserContext& context, StyleSheetContents* styleSheet, const String& rule)
 {
     return CSSParserImpl::parseRule(rule, context, styleSheet, CSSParserImpl::AllowImportRules);