From 86e071c125eb4dd8ef98cc8ffe23a2acd4f9228e Mon Sep 17 00:00:00 2001
From: Henri Sivonen <hsivonen@iki.fi>
Date: Wed, 15 Sep 2010 11:37:55 +0300
Subject: [PATCH] Bug 595844 - Check the namespace of the current element on
 the tree builder stack when deciding whether to support CDATA sections in
 text/html. rs=jonas, a=blocking2.0-betaN.

---
 parser/html/javasrc/Tokenizer.java   | 5 ++---
 parser/html/javasrc/TreeBuilder.java | 9 ++++++++-
 parser/html/nsHtml5Tokenizer.cpp     | 3 +--
 parser/html/nsHtml5TreeBuilder.cpp   | 6 ++++++
 parser/html/nsHtml5TreeBuilder.h     | 1 +
 5 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/parser/html/javasrc/Tokenizer.java b/parser/html/javasrc/Tokenizer.java
index 20388ab4d93b..f6a7aa3ccd73 100644
--- a/parser/html/javasrc/Tokenizer.java
+++ b/parser/html/javasrc/Tokenizer.java
@@ -2354,14 +2354,13 @@ public class Tokenizer implements Locator {
                                 state = Tokenizer.MARKUP_DECLARATION_OCTYPE;
                                 continue stateloop;
                             case '[':
-                                if (tokenHandler.isInForeign()) {
+                                if (tokenHandler.cdataSectionAllowed()) {
                                     clearLongStrBufAndAppend(c);
                                     index = 0;
                                     state = Tokenizer.CDATA_START;
                                     continue stateloop;
-                                } else {
-                                    // fall through
                                 }
+                                // else fall through
                             default:
                                 errBogusComment();
                                 clearLongStrBuf();
diff --git a/parser/html/javasrc/TreeBuilder.java b/parser/html/javasrc/TreeBuilder.java
index 5ca303bb1023..f651306ea3ea 100644
--- a/parser/html/javasrc/TreeBuilder.java
+++ b/parser/html/javasrc/TreeBuilder.java
@@ -5220,6 +5220,14 @@ public abstract class TreeBuilder<T> implements TokenHandler,
 
     // ]NOCPP]
 
+    /**
+     * @see nu.validator.htmlparser.common.TokenHandler#cdataSectionAllowed()
+     */
+    @Override public boolean cdataSectionAllowed() throws SAXException {
+        return inForeign && currentPtr >= 0
+                && stack[currentPtr].ns != "http://www.w3.org/1999/xhtml";
+    }
+
     /**
      * The argument MUST be an interned string or <code>null</code>.
      * 
@@ -5582,7 +5590,6 @@ public abstract class TreeBuilder<T> implements TokenHandler,
     /**
      * Returns the foreignFlag.
      *
-     * @see nu.validator.htmlparser.common.TokenHandler#isInForeign()
      * @return the foreignFlag
      */
     public boolean isInForeign() {
diff --git a/parser/html/nsHtml5Tokenizer.cpp b/parser/html/nsHtml5Tokenizer.cpp
index 061af7ecfea3..a1bd62431311 100644
--- a/parser/html/nsHtml5Tokenizer.cpp
+++ b/parser/html/nsHtml5Tokenizer.cpp
@@ -949,12 +949,11 @@ nsHtml5Tokenizer::stateLoop(PRInt32 state, PRUnichar c, PRInt32 pos, PRUnichar*
               NS_HTML5_CONTINUE(stateloop);
             }
             case '[': {
-              if (tokenHandler->isInForeign()) {
+              if (tokenHandler->cdataSectionAllowed()) {
                 clearLongStrBufAndAppend(c);
                 index = 0;
                 state = NS_HTML5TOKENIZER_CDATA_START;
                 NS_HTML5_CONTINUE(stateloop);
-              } else {
               }
             }
             default: {
diff --git a/parser/html/nsHtml5TreeBuilder.cpp b/parser/html/nsHtml5TreeBuilder.cpp
index 433661ae9a9d..c7b861f270ce 100644
--- a/parser/html/nsHtml5TreeBuilder.cpp
+++ b/parser/html/nsHtml5TreeBuilder.cpp
@@ -3722,6 +3722,12 @@ nsHtml5TreeBuilder::requestSuspension()
   tokenizer->requestSuspension();
 }
 
+PRBool 
+nsHtml5TreeBuilder::cdataSectionAllowed()
+{
+  return inForeign && currentPtr >= 0 && stack[currentPtr]->ns != kNameSpaceID_XHTML;
+}
+
 void 
 nsHtml5TreeBuilder::setFragmentContext(nsIAtom* context, PRInt32 ns, nsIContent** node, PRBool quirks)
 {
diff --git a/parser/html/nsHtml5TreeBuilder.h b/parser/html/nsHtml5TreeBuilder.h
index 08ff51ee7a41..6db06fc9932d 100644
--- a/parser/html/nsHtml5TreeBuilder.h
+++ b/parser/html/nsHtml5TreeBuilder.h
@@ -209,6 +209,7 @@ class nsHtml5TreeBuilder : public nsAHtml5TreeBuilderState
     void elementPushed(PRInt32 ns, nsIAtom* name, nsIContent** node);
     void elementPopped(PRInt32 ns, nsIAtom* name, nsIContent** node);
   public:
+    PRBool cdataSectionAllowed();
     void setFragmentContext(nsIAtom* context, PRInt32 ns, nsIContent** node, PRBool quirks);
   protected:
     nsIContent** currentNode();