CSSGrammer.y should not allow missing closing bracket when it parses querySelector's selector text.

Source/core/css/CSSGrammar.y

 %{
 
 /*
  *  Copyright (C) 2002-2003 Lars Knoll (knoll@kde.org)
  *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  *  Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *  Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  *  Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
@@ skipping 270 matching lines @@
 %type <rule> rule
 %type <rule> valid_rule
 %type <ruleList> block_rule_body
 %type <ruleList> block_rule_list
 %type <rule> block_rule
 %type <rule> block_valid_rule
 %type <rule> supports
 %type <rule> viewport
 %type <boolean> keyframes_rule_start
 
+%type <boolean> closing_square_bracket
+%type <boolean> closing_parenthesis
 %type <string> maybe_ns_prefix
 
 %type <string> namespace_selector
 
 %type <string> string_or_uri
 %type <string> ident_or_string
 %type <string> medium
 %type <marginBox> margin_sym
 
 %type <mediaList> media_list
@@ skipping 147 matching lines @@
   | maybe_sgml SGML_CD
   | maybe_sgml WHITESPACE
   ;
 
 closing_brace:
     '}'
   | %prec LOWEST_PREC TOKEN_EOF
   ;
 
 closing_parenthesis:
-    ')'
-  | %prec LOWEST_PREC TOKEN_EOF
+    ')' { $$ = true; }
+  | %prec LOWEST_PREC TOKEN_EOF {
+      // While parsing query selector's selector text, we should not
+      // allow missing closing parenthesis.
+      $$ = !parser->m_selectorListForParseSelector;
+  }
   ;
 
 closing_square_bracket:
-    ']'
-  | %prec LOWEST_PREC TOKEN_EOF
+    ']' { $$ = true; }
+  | %prec LOWEST_PREC TOKEN_EOF {
+      // While parsing query selector's selector text, we should not
+      // allow missing closing square bracket.
+      $$ = !parser->m_selectorListForParseSelector;
+  }
   ;
 
 semi_or_eof:
     ';'
   | TOKEN_EOF
   ;
 
 maybe_charset:
     /* empty */
   | CHARSET_SYM maybe_space STRING maybe_space semi_or_eof {
@@ skipping 760 matching lines @@
 attr_name:
     IDENT maybe_space {
         if (parser->m_context.isHTMLDocument())
             parser->tokenToLowerCase($1);
         $$ = $1;
     }
     ;
 
 attrib:
     '[' maybe_space attr_name closing_square_bracket {
+        if (!$4)
+            YYERROR;
         $$ = parser->createFloatingSelector();
         $$->setAttribute(QualifiedName(nullAtom, $3, nullAtom));
         $$->setMatch(CSSSelector::Set);
     }
     | '[' maybe_space attr_name match maybe_space ident_or_string maybe_space closing_square_bracket {
+        if (!$8)
+            YYERROR;
         $$ = parser->createFloatingSelector();
         $$->setAttribute(QualifiedName(nullAtom, $3, nullAtom));
         $$->setMatch((CSSSelector::Match)$4);
         $$->setValue($6);
     }
     | '[' maybe_space namespace_selector attr_name closing_square_bracket {
+        if (!$5)
+            YYERROR;
         $$ = parser->createFloatingSelector();
         $$->setAttribute(parser->determineNameInNamespace($3, $4));
         $$->setMatch(CSSSelector::Set);
     }
     | '[' maybe_space namespace_selector attr_name match maybe_space ident_or_string maybe_space closing_square_bracket {
+        if (!$9)
+            YYERROR;
         $$ = parser->createFloatingSelector();
         $$->setAttribute(parser->determineNameInNamespace($3, $4));
         $$->setMatch((CSSSelector::Match)$5);
         $$->setValue($7);
     }
     | '[' selector_recovery closing_square_bracket {
         YYERROR;
     }
   ;
 
@@ skipping 59 matching lines @@
         $$->setValue($4);
         // FIXME: This call is needed to force selector to compute the pseudoType early enough.
         CSSSelector::PseudoType type = $$->pseudoType();
         if (type == CSSSelector::PseudoUnknown) {
             parser->reportError($3, InvalidSelectorPseudoCSSError);
             YYERROR;
         }
     }
     // used by ::cue(:past/:future)
     | ':' ':' CUEFUNCTION maybe_space simple_selector_list maybe_space closing_parenthesis {
+        if (!$7)
+            YYERROR;
         $$ = parser->createFloatingSelector();
         $$->setMatch(CSSSelector::PseudoElement);
         $$->adoptSelectorVector(*parser->sinkFloatingSelectorVector($5));
         $$->setValue($3);
         CSSSelector::PseudoType type = $$->pseudoType();
         if (type != CSSSelector::PseudoCue)
             YYERROR;
     }
     | ':' ':' CUEFUNCTION selector_recovery closing_parenthesis {
         YYERROR;
     }
     // use by :-webkit-any.
     // FIXME: should we support generic selectors here or just simple_selectors?
     // Use simple_selector_list for now to match -moz-any.
     // See http://lists.w3.org/Archives/Public/www-style/2010Sep/0566.html for some
     // related discussion with respect to :not.
     | ':' ANYFUNCTION maybe_space simple_selector_list maybe_space closing_parenthesis {
+        if (!$6)
+            YYERROR;
         $$ = parser->createFloatingSelector();
         $$->setMatch(CSSSelector::PseudoClass);
         $$->adoptSelectorVector(*parser->sinkFloatingSelectorVector($4));
         parser->tokenToLowerCase($2);
         $$->setValue($2);
         CSSSelector::PseudoType type = $$->pseudoType();
         if (type != CSSSelector::PseudoAny)
             YYERROR;
     }
     | ':' ANYFUNCTION selector_recovery closing_parenthesis {
         YYERROR;
     }
     // used by :nth-*(ax+b)
     | ':' FUNCTION maybe_space NTH maybe_space closing_parenthesis {
+        if (!$6)
+            YYERROR;
         $$ = parser->createFloatingSelector();
         $$->setMatch(CSSSelector::PseudoClass);
         $$->setArgument($4);
         $$->setValue($2);
         CSSSelector::PseudoType type = $$->pseudoType();
         if (type == CSSSelector::PseudoUnknown)
             YYERROR;
     }
     // used by :nth-*
     | ':' FUNCTION maybe_space maybe_unary_operator INTEGER maybe_space closing_parenthesis {
+        if (!$7)
+            YYERROR;
         $$ = parser->createFloatingSelector();
         $$->setMatch(CSSSelector::PseudoClass);
         $$->setArgument(AtomicString::number($4 * $5));
         $$->setValue($2);
         CSSSelector::PseudoType type = $$->pseudoType();
         if (type == CSSSelector::PseudoUnknown)
             YYERROR;
     }
     // used by :nth-*(odd/even) and :lang
     | ':' FUNCTION maybe_space IDENT maybe_space closing_parenthesis {
+        if (!$6)
+            YYERROR;
         $$ = parser->createFloatingSelector();
         $$->setMatch(CSSSelector::PseudoClass);
         $$->setArgument($4);
         parser->tokenToLowerCase($2);
         $$->setValue($2);
         CSSSelector::PseudoType type = $$->pseudoType();
         if (type == CSSSelector::PseudoUnknown)
             YYERROR;
         else if (type == CSSSelector::PseudoNthChild ||
                  type == CSSSelector::PseudoNthOfType ||
                  type == CSSSelector::PseudoNthLastChild ||
                  type == CSSSelector::PseudoNthLastOfType) {
             if (!isValidNthToken($4))
                 YYERROR;
         }
     }
     | ':' FUNCTION selector_recovery closing_parenthesis {
         YYERROR;
     }
     // used by :not
     | ':' NOTFUNCTION maybe_space simple_selector maybe_space closing_parenthesis {
+        if (!$6)
+            YYERROR;
         if (!$4->isSimple())
             YYERROR;
         else {
             $$ = parser->createFloatingSelector();
             $$->setMatch(CSSSelector::PseudoClass);
 
             Vector<OwnPtr<CSSParserSelector> > selectorVector;
             selectorVector.append(parser->sinkFloatingSelector($4));
             $$->adoptSelectorVector(selectorVector);
 
             parser->tokenToLowerCase($2);
             $$->setValue($2);
         }
     }
     | ':' NOTFUNCTION selector_recovery closing_parenthesis {
         YYERROR;
     }
     | ':' HOSTFUNCTION maybe_space simple_selector_list maybe_space closing_parenthesis {
+        if (!$6)
+            YYERROR;
         $$ = parser->createFloatingSelector();
         $$->setMatch(CSSSelector::PseudoClass);
         $$->adoptSelectorVector(*parser->sinkFloatingSelectorVector($4));
         parser->tokenToLowerCase($2);
         $$->setValue($2);
         CSSSelector::PseudoType type = $$->pseudoType();
         if (type != CSSSelector::PseudoHost)
             YYERROR;
     }
     | ':' HOSTFUNCTION selector_recovery closing_parenthesis {
         YYERROR;
     }
     //  used by :host-context()
     | ':' HOSTCONTEXTFUNCTION maybe_space simple_selector_list maybe_space closing_parenthesis {
+        if (!$6)
+            YYERROR;
         $$ = parser->createFloatingSelector();
         $$->setMatch(CSSSelector::PseudoClass);
         $$->adoptSelectorVector(*parser->sinkFloatingSelectorVector($4));
         parser->tokenToLowerCase($2);
         $$->setValue($2);
         CSSSelector::PseudoType type = $$->pseudoType();
         if (type != CSSSelector::PseudoHostContext)
             YYERROR;
     }
     | ':' HOSTCONTEXTFUNCTION selector_recovery closing_parenthesis {
@@ skipping 367 matching lines @@
     ;
 
 rule_error_recovery:
     /* empty */
   | rule_error_recovery error
   | rule_error_recovery invalid_square_brackets_block
   | rule_error_recovery invalid_parentheses_block
     ;
 
 %%