Test page: https://bucket.daz.cat/work/igalia/bugs/0.xhtml

The right hand side of a @namespace rule can be any string, with only the empty string having the special meaning of “null namespace or lack of a namespace” [css-namespaces-3]. The rule gives the namespace a nickname that can be used in foo|bar selectors, or when there is no nickname, it restricts the namespace of unqualified type selectors [selectors-4].

*|bar forces the type selector to match any namespace (or none at all), but we treat foo|bar and bar the same way when there is @namespace foo "*" or @namespace "*" respectively. This is unlikely to be a real problem in practice, because XML only allows namespaces with a valid absolute URI, but it’s still incorrect.

The root cause seems to be that SelectorChecker and friends check if QualifiedName::namespaceURI() is starAtom(), which comes from CSSSelectorParser::determineNamespace, which returns starAtom() both when the prefix is star and when the namespace “URI” is star.