Bug 595844 - Check the namespace of the current element on the tree builder stack when deciding whether to support CDATA sections in text/html. rs=jonas, a=blocking2.0-betaN.

parser/html/javasrc/Tokenizer.java

@@ -2354,14 +2354,13 @@ public class Tokenizer implements Locator {
                                 state = Tokenizer.MARKUP_DECLARATION_OCTYPE;
                                 continue stateloop;
                             case '[':
-                                if (tokenHandler.isInForeign()) {
+                                if (tokenHandler.cdataSectionAllowed()) {
                                     clearLongStrBufAndAppend(c);
                                     index = 0;
                                     state = Tokenizer.CDATA_START;
                                     continue stateloop;
-                                } else {
-                                    // fall through
                                 }
+                                // else fall through
                             default:
                                 errBogusComment();
                                 clearLongStrBuf();

parser/html/javasrc/TreeBuilder.java

@@ -5220,6 +5220,14 @@ public abstract class TreeBuilder<T> implements TokenHandler,
 
     // ]NOCPP]
 
+    /**
+     * @see nu.validator.htmlparser.common.TokenHandler#cdataSectionAllowed()
+     */
+    @Override public boolean cdataSectionAllowed() throws SAXException {
+        return inForeign && currentPtr >= 0
+                && stack[currentPtr].ns != "http://www.w3.org/1999/xhtml";
+    }
+
     /**
      * The argument MUST be an interned string or <code>null</code>.
      * 
@@ -5582,7 +5590,6 @@ public abstract class TreeBuilder<T> implements TokenHandler,
     /**
      * Returns the foreignFlag.
      *
-     * @see nu.validator.htmlparser.common.TokenHandler#isInForeign()
      * @return the foreignFlag
      */
     public boolean isInForeign() {

parser/html/nsHtml5Tokenizer.cpp

@@ -949,12 +949,11 @@ nsHtml5Tokenizer::stateLoop(PRInt32 state, PRUnichar c, PRInt32 pos, PRUnichar*
               NS_HTML5_CONTINUE(stateloop);
             }
             case '[': {
-              if (tokenHandler->isInForeign()) {
+              if (tokenHandler->cdataSectionAllowed()) {
                 clearLongStrBufAndAppend(c);
                 index = 0;
                 state = NS_HTML5TOKENIZER_CDATA_START;
                 NS_HTML5_CONTINUE(stateloop);
-              } else {
               }
             }
             default: {

parser/html/nsHtml5TreeBuilder.cpp

@@ -3722,6 +3722,12 @@ nsHtml5TreeBuilder::requestSuspension()
   tokenizer->requestSuspension();
 }
 
+PRBool 
+nsHtml5TreeBuilder::cdataSectionAllowed()
+{
+  return inForeign && currentPtr >= 0 && stack[currentPtr]->ns != kNameSpaceID_XHTML;
+}
+
 void 
 nsHtml5TreeBuilder::setFragmentContext(nsIAtom* context, PRInt32 ns, nsIContent** node, PRBool quirks)
 {

parser/html/nsHtml5TreeBuilder.h

@@ -209,6 +209,7 @@ class nsHtml5TreeBuilder : public nsAHtml5TreeBuilderState
     void elementPushed(PRInt32 ns, nsIAtom* name, nsIContent** node);
     void elementPopped(PRInt32 ns, nsIAtom* name, nsIContent** node);
   public:
+    PRBool cdataSectionAllowed();
     void setFragmentContext(nsIAtom* context, PRInt32 ns, nsIContent** node, PRBool quirks);
   protected:
     nsIContent** currentNode();