Multiple :hover/:active incorrectly matching in quirks mode.

third_party/WebKit/Source/core/css/SelectorChecker.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2004-2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Nicholas Shanks (webkit@nickshanks.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (c) 2011, Code Aurora Forum. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
@@ skipping 137 matching lines @@
 
 static bool shouldMatchHoverOrActive(const SelectorChecker::SelectorCheckingContext& context)
 {
     // If we're in quirks mode, then :hover and :active should never match anchors with no
     // href and *:hover and *:active should not match anything. This is specified in
     // https://quirks.spec.whatwg.org/#the-:active-and-:hover-quirk
     if (!context.element->document().inQuirksMode())
         return true;
     if (context.isSubSelector)
         return true;
-    if (context.selector->relation() == CSSSelector::SubSelector && context.selector->tagHistory())
+    if (context.element->isLink())
         return true;
-    return context.element->isLink();
+    const CSSSelector* selector = context.selector;
+    while (selector->relation() == CSSSelector::SubSelector && selector->tagHistory()) {
+        selector = selector->tagHistory();
+        if (selector->match() != CSSSelector::PseudoClass)
+            return true;
+        if (selector->getPseudoType() != CSSSelector::PseudoHover && selector->getPseudoType() != CSSSelector::PseudoActive)
+            return true;
+    }
+    return false;
 }
 
 static bool isFirstChild(Element& element)
 {
     return !ElementTraversal::previousSibling(element);
 }
 
 static bool isLastChild(Element& element)
 {
     return !ElementTraversal::nextSibling(element);
@@ skipping 964 matching lines @@
 }
 
 bool SelectorChecker::matchesFocusPseudoClass(const Element& element)
 {
     if (InspectorInstrumentation::forcePseudoState(const_cast<Element*>(&element), CSSSelector::PseudoFocus))
         return true;
     return element.focused() && isFrameFocused(element);
 }
 
 } // namespace blink