bug 288460: Make ScanDocStructure() more strict about tags that break the ShouldVerifyHeirarchy check and mark all children of the tag as malformed so that its children don't think they're well formed. r=rbs sr=bzbarsky a=shaver

parser/htmlparser/src/nsHTMLTokenizer.cpp

@@ -426,17 +426,25 @@ nsresult nsHTMLTokenizer::ScanDocStructure(PRBool aFinalChunk)
                 PRInt32 earlyPos = FindLastIndexOfTag(theTag, theStack);
                 if (earlyPos != kNotFound) {
                   // Uh-oh, we've found a tag that is not allowed to nest at
-                  // all. Mark the previous one as malformed to increase our
-                  // chances of doing RS handling on it. We want to do this
-                  // for cases such as: <a><div><a></a></div></a>.
+                  // all. Mark the previous one and all of its children as 
+                  // malformed to increase our chances of doing RS handling
+                  // on all of them. We want to do this for cases such as:
+                  // <a><div><a></a></div></a>.
+                  // Note that we have to iterate through all of the chilren
+                  // of the original malformed tag to protect against:
+                  // <a><font><div><a></a></div></font></a>, so that the <font>
+                  // is allowed to contain the <div>.
                   // XXX What about <a><span><a>, where the second <a> closes
                   // the <span>?
+                  nsDequeIterator it(theStack, earlyPos), end(theStack.End());
+                  while (it < end) {
                     CHTMLToken *theMalformedToken = 
-                    NS_STATIC_CAST(CHTMLToken*, theStack.ObjectAt(earlyPos));
+                        NS_STATIC_CAST(CHTMLToken*, it++);
                   
                     theMalformedToken->SetContainerInfo(eMalformed);
                   }
                 }
+              }
 
               theStack.Push(theToken);
               ++theStackDepth;

xpcom/build/dlldeps.cpp

@@ -128,6 +128,7 @@ void XXXNeverCalled()
     a.Free(0, 0);
     nsIThread::GetCurrent(nsnull);
     nsDeque(nsnull);
+    nsDequeIterator(nsDeque());
     nsTraceRefcnt::LogAddCOMPtr(nsnull, nsnull);
     nsTraceRefcntImpl::DumpStatistics();
     NS_NewEmptyEnumerator(nsnull);

xpcom/ds/nsDeque.h

@@ -245,7 +245,7 @@ private:
  * Here comes the nsDequeIterator class...
  ******************************************************/
 
-class nsDequeIterator {
+class NS_COM nsDequeIterator {
 public:
   /**
    * DequeIterator is an object that knows how to iterate