Bug 520581 - HTML5 parser reverses attributes on some elements. r=bzbarsky.

--HG--
extra : rebase_source : 2018b107ac2e508a20e245d49d396e7c1ea7230d

content/base/src/nsHTMLContentSerializer.cpp

@@ -68,8 +68,6 @@
 #include "nsLWBrkCIID.h"
 #include "nsIScriptElement.h"
 #include "nsAttrName.h"
-#include "nsHtml5Module.h"
-#include "nsIHTMLDocument.h"
 
 static const char kMozStr[] = "moz";
 
@@ -118,31 +116,8 @@ nsHTMLContentSerializer::SerializeHTMLAttributes(nsIContent* aContent,
   nsAutoString nameStr, valueStr;
   NS_NAMED_LITERAL_STRING(_mozStr, "_moz");
 
-  // HTML5 parser stored them in the order they were parsed so we want to
-  // loop forward in that case.
-  nsIDocument* doc = aContent->GetOwnerDocument();
-  PRBool loopForward = PR_FALSE;
-  if (!doc || doc->IsHTML()) {
-    nsCOMPtr<nsIHTMLDocument> htmlDoc(do_QueryInterface(doc));
-    if (htmlDoc) {
-      loopForward = nsHtml5Module::sEnabled;
-    }
-  }
-  PRInt32 index, limit, step;
-  if (loopForward) {
-    index = 0;
-    limit = count;
-    step = 1;
-  }
-  else {
-    // Loop backward over the attributes, since the order they are stored in is
-    // the opposite of the order they were parsed in (see bug 213347 for reason).
-    index = count - 1;
-    limit = -1;
-    step = -1;
-  }
-  
-  for (; index != limit; index += step) {
+  for (PRInt32 index = count; index > 0;) {
+    --index;
     const nsAttrName* name = aContent->GetAttrNameAt(index);
     PRInt32 namespaceID = name->NamespaceID();
     nsIAtom* attrName = name->LocalName();

parser/html/nsHtml5TreeOperation.cpp

@@ -308,7 +308,8 @@ nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor* aBuilder,
       nsIDocument* document = node->GetCurrentDoc();
 
       PRInt32 len = attributes->getLength();
-      for (PRInt32 i = 0; i < len; ++i) {
+      for (PRInt32 i = len; i > 0;) {
+        --i;
         // prefix doesn't need regetting. it is always null or a static atom
         // local name is never null
         nsCOMPtr<nsIAtom> localName = Reget(attributes->getLocalName(i));
@@ -380,7 +381,8 @@ nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor* aBuilder,
       }
 
       PRInt32 len = attributes->getLength();
-      for (PRInt32 i = 0; i < len; ++i) {
+      for (PRInt32 i = len; i > 0;) {
+        --i;
         // prefix doesn't need regetting. it is always null or a static atom
         // local name is never null
         nsCOMPtr<nsIAtom> localName = Reget(attributes->getLocalName(i));