Collect content:attr(...)-features in RuleFeatureSet.

Source/core/css/CSSSelector.h

 /*
  * Copyright (C) 1999-2003 Lars Knoll (knoll@kde.org)
  *               1999 Waldo Bastian (bastian@kde.org)
  * Copyright (C) 2004, 2006, 2007, 2008, 2009, 2010, 2013 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 32 matching lines @@
     // the one in tagHistory(). For example, the CSS selector .a.b #c is represented as:
     //
     // selectorText(): .a.b #c
     // --> (relation == Descendant)
     //   selectorText(): .a.b
     //   --> (relation == SubSelector)
     //     selectorText(): .b
     //
     // The order of tagHistory() varies depending on the situation.
     // * Relations using combinators (http://www.w3.org/TR/css3-selectors/#combinators), such as descendant, sibling, etc., are parsed
-    //   right-to-left (in the example above, this is why .c is earlier in the tagHistory() chain than .a.b).
+    //   right-to-left (in the example above, this is why #c is earlier in the tagHistory() chain than .a.b).
     // * SubSelector relations are parsed left-to-right in most cases (such as the .a.b example above); a counter-example is the
     //   ::content pseudo-element. Most (all?) other pseudo elements and pseudo classes are parsed left-to-right.
     // * ShadowPseudo relations are parsed right-to-left. Example: summary::-webkit-details-marker is parsed as:
     //   selectorText(): summary::-webkit-details-marker
     //    --> (relation == ShadowPseudo)
     //     selectorText(): summary
     //
     // ** match():
     //
     // The match of the current simple selector tells us the type of selector, such as class, id, tagname, or pseudo-class.
@@ skipping 477 matching lines @@
     if (m_hasRareData)
         return m_data.m_rareData->m_value;
     // AtomicString is really just a StringImpl* so the cast below is safe.
     // FIXME: Perhaps call sites could be changed to accept StringImpl?
     return *reinterpret_cast<const AtomicString*>(&m_data.m_value);
 }
 
 } // namespace blink
 
 #endif // CSSSelector_h