From 94f1f84173900afc1cff783a10955ec55453a432 Mon Sep 17 00:00:00 2001
From: Henri Sivonen <hsivonen@iki.fi>
Date: Thu, 3 Nov 2011 16:31:27 +0200
Subject: [PATCH] Bug 699347 - Avoid crashing when viewing source of XML files
 that have an XML declaration without the encoding pseudo-attribute. r=smaug.

---
 parser/html/nsHtml5StreamParser.cpp           | 25 +++++++++++++------
 parser/html/nsHtml5StreamParser.h             |  5 ++--
 .../htmlparser/tests/crashtests/699347-1.xml  |  1 +
 .../tests/crashtests/crashtests.list          |  1 +
 4 files changed, 22 insertions(+), 10 deletions(-)
 create mode 100644 parser/htmlparser/tests/crashtests/699347-1.xml

diff --git a/parser/html/nsHtml5StreamParser.cpp b/parser/html/nsHtml5StreamParser.cpp
index 391a03551ca..d963077a254 100644
--- a/parser/html/nsHtml5StreamParser.cpp
+++ b/parser/html/nsHtml5StreamParser.cpp
@@ -406,15 +406,24 @@ nsHtml5StreamParser::SniffBOMlessUTF16BasicLatin(const PRUint8* aFromSegment,
 }
 
 void
-nsHtml5StreamParser::MaybeSetEncodingFromExpat(const PRUnichar* aEncoding)
+nsHtml5StreamParser::SetEncodingFromExpat(const PRUnichar* aEncoding)
 {
-  nsDependentString utf16(aEncoding);
-  nsCAutoString utf8;
-  CopyUTF16toUTF8(utf16, utf8);
-  if (PreferredForInternalEncodingDecl(utf8)) {
-    mCharset.Assign(utf8);
-    mCharsetSource = kCharsetFromMetaTag; // closest for XML
+  if (aEncoding) {
+    nsDependentString utf16(aEncoding);
+    nsCAutoString utf8;
+    CopyUTF16toUTF8(utf16, utf8);
+    if (PreferredForInternalEncodingDecl(utf8)) {
+      mCharset.Assign(utf8);
+      mCharsetSource = kCharsetFromMetaTag; // closest for XML
+      return;
+    }
+    // else the page declared an encoding Gecko doesn't support and we'd
+    // end up defaulting to UTF-8 anyway. Might as well fall through here
+    // right away and let the encoding be set to UTF-8 which we'd default to
+    // anyway.
   }
+  mCharset.AssignLiteral("UTF-8"); // XML defaults to UTF-8 without a BOM
+  mCharsetSource = kCharsetFromMetaTag; // means confident
 }
 
 // A separate user data struct is used instead of passing the
@@ -436,7 +445,7 @@ HandleXMLDeclaration(void* aUserData,
                      int aStandalone)
 {
   UserData* ud = static_cast<UserData*>(aUserData);
-  ud->mStreamParser->MaybeSetEncodingFromExpat(
+  ud->mStreamParser->SetEncodingFromExpat(
       reinterpret_cast<const PRUnichar*>(aEncoding));
   XML_StopParser(ud->mExpat, false);
 }
diff --git a/parser/html/nsHtml5StreamParser.h b/parser/html/nsHtml5StreamParser.h
index 751fdcd6748..08981888837 100644
--- a/parser/html/nsHtml5StreamParser.h
+++ b/parser/html/nsHtml5StreamParser.h
@@ -210,9 +210,10 @@ class nsHtml5StreamParser : public nsIStreamListener,
 
     /**
      * Sets mCharset and mCharsetSource appropriately for the XML View Source
-     * case if aEncoding names a supported rough ASCII superset.
+     * case if aEncoding names a supported rough ASCII superset and sets
+     * the mCharset and mCharsetSource to the UTF-8 default otherwise.
      */
-    void MaybeSetEncodingFromExpat(const PRUnichar* aEncoding);
+    void SetEncodingFromExpat(const PRUnichar* aEncoding);
 
   private:
 
diff --git a/parser/htmlparser/tests/crashtests/699347-1.xml b/parser/htmlparser/tests/crashtests/699347-1.xml
new file mode 100644
index 00000000000..c6dd4bfa1bb
--- /dev/null
+++ b/parser/htmlparser/tests/crashtests/699347-1.xml
@@ -0,0 +1 @@
+<?xml version="1.0"?><root/>
diff --git a/parser/htmlparser/tests/crashtests/crashtests.list b/parser/htmlparser/tests/crashtests/crashtests.list
index 2982a67a08f..abc26eff060 100644
--- a/parser/htmlparser/tests/crashtests/crashtests.list
+++ b/parser/htmlparser/tests/crashtests/crashtests.list
@@ -48,3 +48,4 @@ load 574884-2.html
 load 591330-1.html
 load 650501-1.xhtml
 load 696651-1.html
+load view-source:699347-1.xml