diff --git a/layout/style/nsCSSParser.cpp b/layout/style/nsCSSParser.cpp index 45d78f93dc..ba97bbd3d7 100644 --- a/layout/style/nsCSSParser.cpp +++ b/layout/style/nsCSSParser.cpp @@ -6552,6 +6552,11 @@ CSSParserImpl::ParsePseudoClassWithSelectorListArg(nsCSSSelector& aSelector, return eSelectorParsingStatus_Error; // our caller calls SkipUntil(')') } + if (nsCSSPseudoClasses::HasSingleSelectorArg(aType) && + slist->mNext) { + return eSelectorParsingStatus_Error; // our caller calls SkipUntil(')') + } + for (nsCSSSelectorList *l = slist; l; l = l->mNext) { nsCSSSelector *s = l->mSelectors; if (s == nullptr) { diff --git a/layout/style/nsCSSPseudoClasses.cpp b/layout/style/nsCSSPseudoClasses.cpp index a174525b1c..928326e399 100644 --- a/layout/style/nsCSSPseudoClasses.cpp +++ b/layout/style/nsCSSPseudoClasses.cpp @@ -102,6 +102,13 @@ nsCSSPseudoClasses::HasNthPairArg(Type aType) aType == Type::nthLastOfType; } +bool +nsCSSPseudoClasses::HasSingleSelectorArg(Type aType) +{ + return aType == Type::host || + aType == Type::hostContext; +} + void nsCSSPseudoClasses::PseudoTypeToString(Type aType, nsAString& aString) { diff --git a/layout/style/nsCSSPseudoClasses.h b/layout/style/nsCSSPseudoClasses.h index 4a4bbe188c..76fcef3f78 100644 --- a/layout/style/nsCSSPseudoClasses.h +++ b/layout/style/nsCSSPseudoClasses.h @@ -58,6 +58,7 @@ public: static Type GetPseudoType(nsIAtom* aAtom, EnabledState aEnabledState); static bool HasStringArg(Type aType); static bool HasNthPairArg(Type aType); + static bool HasSingleSelectorArg(Type aType); static bool HasForgivingSelectorListArg(Type aType) { return aType == Type::is || aType == Type::matches ||