Issue #2078 - Part 6: Replace empty list head with the next non-empty list for forgiving selector lists

What happens here if aListHead is an empty selector list:
(1) next selector group is parsed and continues to the next iteration if it's empty or invalid
(2) if we're a forgiving selector list and aListHead is empty, replace it with the selector group that we've just parsed
(3) step 1 ignores invalid/empty, so we assert that step 2 should never have an empty selector list

1 files changed, 9 insertions, 2 deletions

diff --git a/layout/style/nsCSSParser.cpp b/layout/style/nsCSSParser.cpp
index 7775df29cd..c81de2d9f6 100644
--- a/layout/style/nsCSSParser.cpp
+++ b/layout/style/nsCSSParser.cpp
@@ -5492,8 +5492,15 @@ CSSParserImpl::ParseSelectorList(nsCSSSelectorList*& aListHead,
           }
           break;
         }
-        // add new list to the end of the selector list
-        list->mNext = newList;
+        // Replace the list head if: it's empty and we're a forgiving selector
+        // list. Otherwise, add the new list to the end of the selector list.
+        if (aIsForgiving && !aListHead->mSelectors) {
+          MOZ_ASSERT(newList->mSelectors,
+                     "replacing empty list head with an empty selector list?");
+          aListHead = newList;
+        } else {
+          list->mNext = newList;
+        }
         list = newList;
         continue;
       } else if (aStopChar == tk->mSymbol && aStopChar != char16_t(0)) {