Bug 959150 part 7 - Retain probable bugs instead of changing behavior right now. r=smaug.

parser/html/nsHtml5TreeBuilderCppSupplement.h

@@ -535,7 +535,8 @@ nsHtml5TreeBuilder::markMalformedIfScript(nsIContentHandle* aElement)
   NS_PRECONDITION(aElement, "Null element");
 
   if (mBuilder) {
-    // XXX innerHTML
+    nsHtml5TreeOperation::MarkMalformedIfScript(
+      static_cast<nsIContent*>(aElement));
     return;
   }
 
@@ -732,12 +733,11 @@ nsHtml5TreeBuilder::elementPopped(int32_t aNamespace, nsIAtom* aName, nsIContent
     return;
   }
   if (aNamespace == kNameSpaceID_SVG) {
-    if (mBuilder) {
-      // XXX innerHTML
-      // is this ever needed for the on-the-main-thread case
-      return;
-    }
     if (aName == nsHtml5Atoms::svg) {
+      if (mBuilder) {
+        nsHtml5TreeOperation::SvgLoad(static_cast<nsIContent*>(aElement));
+        return;
+      }
       nsHtml5TreeOperation* treeOp = mOpQueue.AppendElement();
       NS_ASSERTION(treeOp, "Tree op allocation failed.");
       treeOp->Init(eTreeOpSvgLoad, aElement);

parser/html/nsHtml5TreeOperation.cpp

@@ -621,6 +621,25 @@ nsHtml5TreeOperation::DoneCreatingElement(nsIContent* aNode)
   aNode->DoneCreatingElement();
 }
 
+void
+nsHtml5TreeOperation::SvgLoad(nsIContent* aNode)
+{
+  nsCOMPtr<nsIRunnable> event = new nsHtml5SVGLoadDispatcher(aNode);
+  if (NS_FAILED(NS_DispatchToMainThread(event))) {
+    NS_WARNING("failed to dispatch svg load dispatcher");
+  }
+}
+
+void
+nsHtml5TreeOperation::MarkMalformedIfScript(nsIContent* aNode)
+{
+  nsCOMPtr<nsIScriptElement> sele = do_QueryInterface(aNode);
+  if (sele) {
+    // Make sure to serialize this script correctly, for nice round tripping.
+    sele->SetIsMalformed();
+  }
+}
+
 nsresult
 nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor* aBuilder,
                               nsIContent** aScriptElement)
@@ -788,11 +807,7 @@ nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor* aBuilder,
     }
     case eTreeOpMarkMalformedIfScript: {
       nsIContent* node = *(mOne.node);
-      nsCOMPtr<nsIScriptElement> sele = do_QueryInterface(node);
-      if (sele) {
-        // Make sure to serialize this script correctly, for nice round tripping.
-        sele->SetIsMalformed();
-      }
+      MarkMalformedIfScript(node);
       return NS_OK;
     }
     case eTreeOpStreamEnded: {
@@ -824,10 +839,7 @@ nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor* aBuilder,
     }
     case eTreeOpSvgLoad: {
       nsIContent* node = *(mOne.node);
-      nsCOMPtr<nsIRunnable> event = new nsHtml5SVGLoadDispatcher(node);
-      if (NS_FAILED(NS_DispatchToMainThread(event))) {
-        NS_WARNING("failed to dispatch svg load dispatcher");
-      }
+      SvgLoad(node);
       return NS_OK;
     }
     case eTreeOpMaybeComplainAboutCharset: {

parser/html/nsHtml5TreeOperation.h

@@ -187,6 +187,10 @@ class nsHtml5TreeOperation {
 
     static void DoneCreatingElement(nsIContent* aNode);
 
+    static void SvgLoad(nsIContent* aNode);
+
+    static void MarkMalformedIfScript(nsIContent* aNode);
+
     nsHtml5TreeOperation();
 
     ~nsHtml5TreeOperation();