Bug 1375701 - Atomize class attribute value in the parser in the innerHTML case. r=Ehsan

MozReview-Commit-ID: CKyGlzYS15e
2017-08-11 09:22:57 +03:00
parent 6ea0512630
commit fa792cb56c
14 changed files with 292 additions and 162 deletions
--- a/parser/html/nsHtml5Tokenizer.cpp
+++ b/parser/html/nsHtml5Tokenizer.cpp
@@ -231,8 +231,13 @@ nsHtml5Tokenizer::emitOrAppendCharRefBuf(int32_t returnState)
 nsHtml5String
 nsHtml5Tokenizer::strBufToString()
 {
-  nsHtml5String str =
-    nsHtml5Portability::newStringFromBuffer(strBuf, 0, strBufLen, tokenHandler);
+  nsHtml5String str = nsHtml5Portability::newStringFromBuffer(
+    strBuf,
+    0,
+    strBufLen,
+    tokenHandler,
+    !newAttributesEachTime &&
+      attributeName == nsHtml5AttributeName::ATTR_CLASS);
  clearStrBufAfterUse();
  return str;
 }