1 files changed, 37 insertions, 33 deletions

diff --git a/WebCore/css/CSSSelector.cpp b/WebCore/css/CSSSelector.cpp
index 03974d9..1f336a2 100644
--- a/WebCore/css/CSSSelector.cpp
+++ b/WebCore/css/CSSSelector.cpp
@@ -67,42 +67,46 @@ private:
     Vector<CSSSelector*, 16> m_stack;
 };
 
-unsigned int CSSSelector::specificity()
+unsigned CSSSelector::specificity() const
 {
-    if (m_isForPage)
-        return specificityForPage();
+    // make sure the result doesn't overflow
+    static const unsigned maxValueMask = 0xffffff;
+    unsigned total = 0;
+    for (const CSSSelector* selector = this; selector; selector = selector->tagHistory()) {
+        if (selector->m_isForPage)
+            return (total + selector->specificityForPage()) & maxValueMask;
+        total = (total + selector->specificityForOneSelector()) & maxValueMask;
+    }
+    return total;
+}
 
+inline unsigned CSSSelector::specificityForOneSelector() const
+{
     // FIXME: Pseudo-elements and pseudo-classes do not have the same specificity. This function
     // isn't quite correct.
-    int s = (m_tag.localName() == starAtom ? 0 : 1);
+    unsigned s = (m_tag.localName() == starAtom ? 0 : 1);
     switch (m_match) {
-        case Id:
-            s += 0x10000;
-            break;
-        case Exact:
-        case Class:
-        case Set:
-        case List:
-        case Hyphen:
-        case PseudoClass:
-        case PseudoElement:
-        case Contain:
-        case Begin:
-        case End:
-            s += 0x100;
-        case None:
-            break;
+    case Id:
+        s += 0x10000;
+        break;
+    case Exact:
+    case Class:
+    case Set:
+    case List:
+    case Hyphen:
+    case PseudoClass:
+    case PseudoElement:
+    case Contain:
+    case Begin:
+    case End:
+        s += 0x100;
+    case None:
+        break;
     }
-
-    // FIXME: Avoid recursive calls to prevent possible stack overflow.
-    if (CSSSelector* tagHistory = this->tagHistory())
-        s += tagHistory->specificity();
-
-    // make sure it doesn't overflow
-    return s & 0xffffff;
+    return s;
 }
 
-unsigned CSSSelector::specificityForPage()
+unsigned CSSSelector::specificityForPage() const
 {
     // See http://dev.w3.org/csswg/css3-page/#cascading-and-page-context
     unsigned s = (m_tag.localName() == starAtom ? 0 : 4);
@@ -902,8 +906,8 @@ bool CSSSelector::RareData::parseNth()
         m_a = 2;
         m_b = 0;
     } else {
-        int n = argument.find('n');
-        if (n != -1) {
+        size_t n = argument.find('n');
+        if (n != notFound) {
             if (argument[0] == '-') {
                 if (n == 1)
                     m_a = -1; // -n == -1n
@@ -914,12 +918,12 @@ bool CSSSelector::RareData::parseNth()
             else
                 m_a = argument.substring(0, n).toInt();
             
-            int p = argument.find('+', n);
-            if (p != -1)
+            size_t p = argument.find('+', n);
+            if (p != notFound)
                 m_b = argument.substring(p + 1, argument.length() - p - 1).toInt();
             else {
                 p = argument.find('-', n);
-                if (p != -1)
+                if (p != notFound)
                     m_b = -argument.substring(p + 1, argument.length() - p - 1).toInt();
             }
         } else