List marker pseudo elements.

Source/core/css/parser/CSSSelectorParser.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/css/parser/CSSSelectorParser.h"
 
 #include "core/css/CSSSelectorList.h"
 #include "core/css/StyleSheetContents.h"
 #include "core/frame/UseCounter.h"
@@ skipping 242 matching lines @@
     if (attributeValue.type() != IdentToken && attributeValue.type() != StringToken)
         return nullptr;
     selector->setValue(attributeValue.value());
     selector->setAttribute(qualifiedName, consumeAttributeFlags(block));
 
     if (!block.atEnd())
         return nullptr;
     return selector.release();
 }
 
+bool CSSSelectorParser::selectorIsAllowedInParsingMode(CSSSelector::PseudoType type) const
+{
+    if (isUASheetBehavior(m_context.mode()))
+        return true;
+    return type != CSSSelector::PseudoMarker;
+}
+
 PassOwnPtr<CSSParserSelector> CSSSelectorParser::consumePseudo(CSSParserTokenRange& range)
 {
     ASSERT(range.peek().type() == ColonToken);
     range.consume();
 
     int colons = 1;
     if (range.peek().type() == ColonToken) {
         range.consume();
         colons++;
     }
 
     const CSSParserToken& token = range.peek();
     if (token.type() != IdentToken && token.type() != FunctionToken)
         return nullptr;
 
     OwnPtr<CSSParserSelector> selector = CSSParserSelector::create();
     selector->setMatch(colons == 1 ? CSSSelector::PseudoClass : CSSSelector::PseudoElement);
     selector->setValue(AtomicString(String(token.value()).lower()));
 
     if (token.type() == IdentToken) {
         range.consume();
-        if (selector->pseudoType() == CSSSelector::PseudoUnknown)
+        if (selector->pseudoType() == CSSSelector::PseudoUnknown
+            || !selectorIsAllowedInParsingMode(selector->pseudoType())) {
             return nullptr;
+        }
         return selector.release();
     }
 
     CSSParserTokenRange block = range.consumeBlock();
     block.consumeWhitespace();
 
     if ((colons == 1
         && (token.valueEqualsIgnoringCase("host")
             || token.valueEqualsIgnoringCase("host-context")
             || token.valueEqualsIgnoringCase("-webkit-any")))
@@ skipping 379 matching lines @@
                 context.useCounter()->count(feature);
             if (current->relation() == CSSSelector::ShadowDeep)
                 context.useCounter()->count(UseCounter::CSSDeepCombinator);
             if (current->selectorList())
                 recordSelectorStats(context, *current->selectorList());
         }
     }
 }
 
 } // namespace blink