这个polyfill如何为document.queryselectorall工作？

Question

我正在尝试了解queryselector的这个polyfill？特别是这一行：

styleTag.styleSheet.cssText = selector + "{x:expression(document.__qsaels.push(this))}";

https://gist.github.com/connrs/2724353

if (!document.querySelectorAll) {
    document.querySelectorAll = function(selector) {
        var doc = document,
            head = doc.documentElement.firstChild,
            styleTag = doc.createElement('STYLE');
        head.appendChild(styleTag);
        doc.__qsaels = [];

        styleTag.styleSheet.cssText = selector + "{x:expression(document.__qsaels.push(this))}";
        window.scrollBy(0, 0);

        return doc.__qsaels;
    }
}

Answer 1

滥用CSS的expression "feature"。在计算x属性的样式（由scrollBy(0, 0)触发的重排时发生）时，Internet Explorer将为与选择器匹配的所有元素执行此代码段。

自IE 8以来

CSS expressions are officially despised ......