Some invalid media queries are parsed as valid

Source/core/css/parser/MediaQueryParser.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/css/parser/MediaQueryParser.h"
 
 #include "core/MediaTypeNames.h"
 #include "core/css/parser/CSSPropertyParser.h"
 #include "core/css/parser/CSSTokenizer.h"
@@ skipping 58 matching lines @@
 }
 
 void MediaQueryParser::readMediaNot(CSSParserTokenType type, const CSSParserToken& token)
 {
     if (type == IdentToken && equalIgnoringCase(token.value(), "not"))
         setStateAndRestrict(ReadFeatureStart, MediaQuery::Not);
     else
         readFeatureStart(type, token);
 }
 
+static bool isRestrictorOrLogicalOperator(const String& tokenValue)
+{
+    // FIXME: it would be more efficient to use lower-case always for tokenValue.
+    return equalIgnoringCase(tokenValue, "not")
+        || equalIgnoringCase(tokenValue, "and")
+        || equalIgnoringCase(tokenValue, "or")
+        || equalIgnoringCase(tokenValue, "only");
+}
+
 void MediaQueryParser::readMediaType(CSSParserTokenType type, const CSSParserToken& token)
 {
     if (type == LeftParenthesisToken) {
-        m_state = ReadFeature;
+        if (m_mediaQueryData.restrictor() != MediaQuery::None)
+            m_state = SkipUntilComma;
+        else
+            m_state = ReadFeature;
     } else if (type == IdentToken) {
         if (m_state == ReadRestrictor && equalIgnoringCase(token.value(), "not")) {
             setStateAndRestrict(ReadMediaType, MediaQuery::Not);
         } else if (m_state == ReadRestrictor && equalIgnoringCase(token.value(), "only")) {
             setStateAndRestrict(ReadMediaType, MediaQuery::Only);
+        } else if (m_mediaQueryData.restrictor() != MediaQuery::None
+            && isRestrictorOrLogicalOperator(token.value())) {
+            m_state = SkipUntilComma;
         } else {
             m_mediaQueryData.setMediaType(token.value());
             m_state = ReadAnd;
         }
     } else if (type == EOFToken && (!m_querySet->queryVector().size() || m_state != ReadRestrictor)) {
         m_state = Done;
     } else {
         m_state = SkipUntilComma;
         if (type == CommaToken)
             skipUntilComma(type, token);
@@ skipping 182 matching lines @@
     return true;
 }
 
 void MediaQueryData::setMediaType(const String& mediaType)
 {
     m_mediaType = mediaType;
     m_mediaTypeSet = true;
 }
 
 } // namespace blink