WebCore::CSSSelector::RareData::parseNth doesn't check whether the search for '-' in the argument was successful. This results in incorrect parsing. For example, '3n' is parsed as if it were '3n-3'. The code has been working OK just accidentally.
Created attachment 53650 [details] Fix nth-* pseudo-class parsing.
Comment on attachment 53650 [details] Fix nth-* pseudo-class parsing. This change looks good. How -n-3 will be parsed, by the way? I'm not sure, but I guess it will be parsed as -n-0, right?
-n-3 is parsed correctly. In determining m_b, '-' is searched by argument.find('-', 1), which finds the second '-' before '3'.
Committed r58300: <http://trac.webkit.org/changeset/58300>
The original behavior was actually incorrect and the patch did fix it. Please see: https://bugs.webkit.org/show_bug.cgi?id=31267 . I added tests there.