Enforce Unique Att Spec for XML in JS (277664, r=shaver).

js/src/js.msg

@@ -257,7 +257,7 @@ MSG_DEF(JSMSG_BRACKET_AFTER_ATTR_EXPR,174, 0, JSEXN_SYNTAXERR, "missing ] after
 MSG_DEF(JSMSG_NAME_AFTER_DBLDOT,      175, 0, JSEXN_SYNTAXERR, "missing name after .. operator")
 MSG_DEF(JSMSG_CURLY_IN_XML_EXPR,      176, 0, JSEXN_SYNTAXERR, "missing } in XML expression")
 MSG_DEF(JSMSG_BAD_XML_NAMESPACE,      177, 1, JSEXN_TYPEERR, "invalid XML namespace {0}")
-MSG_DEF(JSMSG_BAD_XML_ATTRIBUTE_NAME, 178, 1, JSEXN_TYPEERR, "invalid XML attribute name {0}")
+MSG_DEF(JSMSG_BAD_XML_ATTR_NAME,      178, 1, JSEXN_TYPEERR, "invalid XML attribute name {0}")
 MSG_DEF(JSMSG_BAD_XML_NAME,           179, 1, JSEXN_TYPEERR, "invalid XML name {0}")
 MSG_DEF(JSMSG_BAD_XML_CONVERSION,     180, 1, JSEXN_TYPEERR, "can't convert {0} to XML")
 MSG_DEF(JSMSG_BAD_XMLLIST_CONVERSION, 181, 1, JSEXN_TYPEERR, "can't convert {0} to XMLList")
@@ -277,3 +277,4 @@ MSG_DEF(JSMSG_BAD_XMLLIST_PUT,        194, 1, JSEXN_TYPEERR, "can't set property
 MSG_DEF(JSMSG_UNKNOWN_XML_ENTITY,     195, 1, JSEXN_TYPEERR, "unknown XML entity {0}")
 MSG_DEF(JSMSG_BAD_XML_NCR,            196, 1, JSEXN_TYPEERR, "malformed XML character {0}")
 MSG_DEF(JSMSG_UNDEFINED_XML_NAME,     197, 1, JSEXN_TYPEERR, "reference to undefined XML name {0}")
+MSG_DEF(JSMSG_DUPLICATE_XML_ATTR,     198, 1, JSEXN_TYPEERR, "duplicate XML attribute {0}")

js/src/jsxml.c

@@ -1447,7 +1447,7 @@ ParseNodeToXML(JSContext *cx, JSParseNode *pn, JSXMLArray *inScopeNSes,
     JSBool inLRS;
     JSString *str;
     uint32 length, n, i;
-    JSParseNode *pn2, *next, **pnp;
+    JSParseNode *pn2, *pn3, *head, **pnp;
     JSXMLNamespace *ns;
     JSXMLQName *qn;
     JSXMLClass xml_class;
@@ -1478,8 +1478,7 @@ ParseNodeToXML(JSContext *cx, JSParseNode *pn, JSXMLArray *inScopeNSes,
 
         i = 0;
         while ((pn2 = pn2->pn_next) != NULL) {
-            next = pn2->pn_next;
-            if (!next) {
+            if (!pn2->pn_next) {
                 /* Don't append the end tag! */
                 JS_ASSERT(pn2->pn_type == TOK_XMLETAGO);
                 break;
@@ -1586,6 +1585,7 @@ ParseNodeToXML(JSContext *cx, JSParseNode *pn, JSXMLArray *inScopeNSes,
         JS_ASSERT(pn->pn_count >= 1);
         n = pn->pn_count - 1;
         pnp = &pn2->pn_next;
+        head = *pnp;
         while ((pn2 = *pnp) != NULL) {
             size_t length;
             const jschar *chars;
@@ -1593,6 +1593,18 @@ ParseNodeToXML(JSContext *cx, JSParseNode *pn, JSXMLArray *inScopeNSes,
             if (pn2->pn_type != TOK_XMLNAME || pn2->pn_arity != PN_NULLARY)
                 goto syntax;
 
+            /* Enforce "Well-formedness constraint: Unique Att Spec". */
+            for (pn3 = head; pn3 != pn2; pn3 = pn3->pn_next->pn_next) {
+                if (pn3->pn_atom == pn2->pn_atom) {
+                    js_ReportCompileErrorNumber(cx, pn2,
+                                                JSREPORT_PN | JSREPORT_ERROR,
+                                                JSMSG_DUPLICATE_XML_ATTR,
+                                                js_ValueToPrintableString(cx,
+                                                    ATOM_KEY(pn2->pn_atom)));
+                    return NULL;
+                }
+            }
+
             str = ATOM_TO_STRING(pn2->pn_atom);
             pn2 = pn2->pn_next;
             JS_ASSERT(pn2);
@@ -2830,7 +2842,7 @@ ToAttributeName(JSContext *cx, jsval v)
             name = js_DecompileValueGenerator(cx, JSDVG_IGNORE_STACK, v, NULL);
             if (name) {
                 JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
-                                     JSMSG_BAD_XML_ATTRIBUTE_NAME,
+                                     JSMSG_BAD_XML_ATTR_NAME,
                                      JS_GetStringBytes(name));
             }
             return NULL;