More bug 325404. Use the right charset when parsing baseuris, and fix copy-n-paste error. r/sr=jst

content/html/content/src/nsGenericHTMLElement.cpp

@@ -1905,7 +1905,7 @@ void
 nsGenericHTMLElement::GetBaseTarget(nsAString& aBaseTarget) const
 {
   void* prop;
-  if (HasProperties() && (prop = GetProperty(nsHTMLAtoms::htmlBaseHref))) {
+  if (HasProperties() && (prop = GetProperty(nsHTMLAtoms::htmlBaseTarget))) {
     NS_STATIC_CAST(nsIAtom*, prop)->ToString(aBaseTarget);
     
     return;

content/html/document/src/nsHTMLContentSink.cpp

@@ -3590,7 +3590,9 @@ HTMLContentSink::ProcessBASEElement(nsGenericHTMLElement* aElement)
     //-- Make sure this page is allowed to load this URI
     nsresult rv;
     nsCOMPtr<nsIURI> baseHrefURI;
-    rv = NS_NewURI(getter_AddRefs(baseHrefURI), attrValue, nsnull);
+    rv = nsContentUtils::NewURIWithDocumentCharset(getter_AddRefs(baseHrefURI),
+                                                   attrValue, mDocument,
+                                                   nsnull);
     if (NS_FAILED(rv))
       return;
 

content/html/document/src/nsHTMLFragmentContentSink.cpp

@@ -302,7 +302,10 @@ nsHTMLFragmentContentSink::ProcessBaseTag(nsIContent* aContent)
   nsAutoString value;
   if (aContent->GetAttr(kNameSpaceID_None, nsHTMLAtoms::href, value)) {
     nsCOMPtr<nsIURI> baseHrefURI;
-    nsresult rv = NS_NewURI(getter_AddRefs(baseHrefURI), value, nsnull);
+    nsresult rv = 
+      nsContentUtils::NewURIWithDocumentCharset(getter_AddRefs(baseHrefURI),
+                                                value, mTargetDocument,
+                                                nsnull);
     if (NS_FAILED(rv))
       return;