diff --git a/parser/html/javasrc/TreeBuilder.java b/parser/html/javasrc/TreeBuilder.java
index dc20c79737e5..5db4d12269db 100644
--- a/parser/html/javasrc/TreeBuilder.java
+++ b/parser/html/javasrc/TreeBuilder.java
@@ -3359,6 +3359,7 @@ public abstract class TreeBuilder implements TokenHandler,
}
}
eltPos = currentPtr;
+ int origPos = currentPtr;
for (;;) {
if (eltPos == 0) {
assert fragment: "We can get this close to the root of the stack in foreign content only in the fragment case.";
@@ -3366,7 +3367,7 @@ public abstract class TreeBuilder implements TokenHandler,
}
if (stack[eltPos].name == name) {
while (currentPtr >= eltPos) {
- pop();
+ popForeign(origPos);
}
break endtagloop;
}
@@ -5225,6 +5226,17 @@ public abstract class TreeBuilder implements TokenHandler,
node.release(this);
}
+ private void popForeign(int origPos) throws SAXException {
+ StackNode node = stack[currentPtr];
+ if (origPos != currentPtr) {
+ markMalformedIfScript(node.node);
+ }
+ assert debugOnlyClearLastStackSlot();
+ currentPtr--;
+ elementPopped(node.ns, node.popName, node.node);
+ node.release(this);
+ }
+
private void silentPop() throws SAXException {
StackNode node = stack[currentPtr];
assert debugOnlyClearLastStackSlot();
diff --git a/parser/html/nsHtml5TreeBuilder.cpp b/parser/html/nsHtml5TreeBuilder.cpp
index b930eb14a95a..a627658aa391 100644
--- a/parser/html/nsHtml5TreeBuilder.cpp
+++ b/parser/html/nsHtml5TreeBuilder.cpp
@@ -2349,6 +2349,7 @@ void nsHtml5TreeBuilder::endTag(nsHtml5ElementName* elementName) {
}
}
eltPos = currentPtr;
+ int32_t origPos = currentPtr;
for (;;) {
if (!eltPos) {
MOZ_ASSERT(fragment,
@@ -2358,7 +2359,7 @@ void nsHtml5TreeBuilder::endTag(nsHtml5ElementName* elementName) {
}
if (stack[eltPos]->name == name) {
while (currentPtr >= eltPos) {
- pop();
+ popForeign(origPos);
}
NS_HTML5_BREAK(endtagloop);
}
@@ -4086,6 +4087,17 @@ void nsHtml5TreeBuilder::pop() {
node->release(this);
}
+void nsHtml5TreeBuilder::popForeign(int32_t origPos) {
+ nsHtml5StackNode* node = stack[currentPtr];
+ if (origPos != currentPtr) {
+ markMalformedIfScript(node->node);
+ }
+ MOZ_ASSERT(debugOnlyClearLastStackSlot());
+ currentPtr--;
+ elementPopped(node->ns, node->popName, node->node);
+ node->release(this);
+}
+
void nsHtml5TreeBuilder::silentPop() {
nsHtml5StackNode* node = stack[currentPtr];
MOZ_ASSERT(debugOnlyClearLastStackSlot());
diff --git a/parser/html/nsHtml5TreeBuilder.h b/parser/html/nsHtml5TreeBuilder.h
index 68f788e55d47..3589ddfb6446 100644
--- a/parser/html/nsHtml5TreeBuilder.h
+++ b/parser/html/nsHtml5TreeBuilder.h
@@ -456,6 +456,7 @@ class nsHtml5TreeBuilder : public nsAHtml5TreeBuilderState {
bool isInStack(nsHtml5StackNode* node);
void popTemplateMode();
void pop();
+ void popForeign(int32_t origPos);
void silentPop();
void popOnEof();
void appendHtmlElementToDocumentAndPush(nsHtml5HtmlAttributes* attributes);
diff --git a/testing/web-platform/tests/html/syntax/parsing/unclosed-svg-script.html b/testing/web-platform/tests/html/syntax/parsing/unclosed-svg-script.html
new file mode 100644
index 000000000000..80f662a3f787
--- /dev/null
+++ b/testing/web-platform/tests/html/syntax/parsing/unclosed-svg-script.html
@@ -0,0 +1,30 @@
+
+
+
+
+
+
+
+
+