Some invalid media queries are parsed as valid

Source/core/css/parser/MediaQueryParser.cpp

Index: Source/core/css/parser/MediaQueryParser.cpp
diff --git a/Source/core/css/parser/MediaQueryParser.cpp b/Source/core/css/parser/MediaQueryParser.cpp
index f1a1a2438223bb92fdd8678db216f0cff21c14f5..92e3fe0dd6269062dc80bc3a0b4a158c4ee4f529 100644
--- a/Source/core/css/parser/MediaQueryParser.cpp
+++ b/Source/core/css/parser/MediaQueryParser.cpp
@@ -79,15 +79,25 @@ void MediaQueryParser::readMediaNot(CSSParserTokenType type, const CSSParserToke
 void MediaQueryParser::readMediaType(CSSParserTokenType type, const CSSParserToken& token)
 {
     if (type == LeftParenthesisToken) {
-        m_state = ReadFeature;
+        if (m_mediaQueryData.restrictor() != MediaQuery::None)
+            m_state = SkipUntilComma;
+        else
+            m_state = ReadFeature;
     } else if (type == IdentToken) {
         if (m_state == ReadRestrictor && equalIgnoringCase(token.value(), "not")) {
             setStateAndRestrict(ReadMediaType, MediaQuery::Not);
         } else if (m_state == ReadRestrictor && equalIgnoringCase(token.value(), "only")) {
             setStateAndRestrict(ReadMediaType, MediaQuery::Only);
         } else {

[Yoav Weiss, 2015/01/30 08:31:51]

Nit: Can you make that an "else if"?

-            m_mediaQueryData.setMediaType(token.value());
-            m_state = ReadAnd;
+            if (m_mediaQueryData.restrictor() != MediaQuery::None && (equalIgnoringCase(token.value(), "not")
+                || equalIgnoringCase(token.value(), "and")
+                || equalIgnoringCase(token.value(), "or")
+                || equalIgnoringCase(token.value(), "only"))) {

[Yoav Weiss, 2015/01/30 08:31:51]

Can you break out the "equqlIgnoringCase"s into their own helper function?
"isRestrictorOrLogicalOperator" (or a better name :) )?

Also - I don't know if this is a performance bottleneck in any way, but we're
starting to lowercase that token a few times too many... Can you add a FIXME in
that spirit, so we'd later move the lowercasing up the chain.

+                m_state = SkipUntilComma;
+            } else {
+                m_mediaQueryData.setMediaType(token.value());
+                m_state = ReadAnd;
+            }
         }
     } else if (type == EOFToken && (!m_querySet->queryVector().size() || m_state != ReadRestrictor)) {
         m_state = Done;