598683 - Bad XML with unterminated node with namespace not throwing correctly

Status: RESOLVED FIXED

(Tamarin Graveyard :: Virtual Machine, defect)

Description

[Werner Sharp]

var xml:XML=new XML("<a><b:c xmlns:b=\"abc\"></d:c></a>") ;
trace(xml);

February 2009 merge into player code injected this bug.  The XMLObject closing tag handling has been broken with nodes with namespaces.  The code is currently:

                        if (!NodeNameEquals(tag.text, nodeNameStart, parentName, ns) &&
                            // We're trying to support paired nodes where the first node gets a namespace
                            // from the default namespace.
                            parentName->Compare(*tag.text, nodeNameStart, tag.text->length()-nodeNameStart) != 0 &&
                            ns->getURI() == toplevel->getDefaultNamespace()->getURI())
                        {

...and should be...

                        if (!NodeNameEquals(tag.text, nodeNameStart, parentName, ns) &&
                            // We're trying to support paired nodes where the first node gets a namespace
                            // from the default namespace.
                            !(parentName->Compare(*tag.text, nodeNameStart, tag.text->length()-nodeNameStart) == 0 &&
                            ns->getURI() == toplevel->getDefaultNamespace()->getURI()))

Prior to string changes, etc., it was...

						if ((!NodeNameEquals (thisNodeNameNoSlash, noSlashLen, parentName, ns)) &&
							// We're trying to support paired nodes where the first node gets a namespace
							// from the default namespace.
							(!(m.getName()->Equals (thisNodeNameNoSlash, noSlashLen) && (ns->getURI() == ns2->getURI()))))
						{

Comment 1

[Werner Sharp]

Attachment: fix the if statement, add a regression test

Comment 2

[Werner Sharp]

http://hg.mozilla.org/tamarin-redux/rev/de2041ef45dd

Comment 3

[Steven Johnson]

Reopening -- it turns out that existing content depends on this bug (!) so we need to version this fix for SWF12-or-later.

Comment 4

[Steven Johnson]

Attachment: Patch

Note that the patch makes the fix conditional on SWF11 (not SWF12 as the previous comment indicated)

Comment 5

[Steven Johnson]

(I just noticed there are some naked tabs in the patch; you can assume those will be cleansed)

Comment 6

[Lars T Hansen]

Comment on attachment 509551 [details] [diff] [review]
Patch

Fine from an SR point of view; deferring to Werner on functionality.

Comment 7

[Steven Johnson]

new patch pushed to TR 5893:40d8d58360c7