Mozilla bug 1534346 - Mark malformed SVG scripts as malformed for real. r=alchen

Author: hsivonen

src/nu/validator/htmlparser/impl/TreeBuilder.java

@@ -3361,7 +3361,7 @@ public final void endTag(ElementName elementName) throws SAXException {
                     }
                     if (stack[eltPos].name == name) {
                         while (currentPtr >= eltPos) {
-                            popForeign(origPos);
+                            popForeign(origPos, eltPos);
                         }
                         break endtagloop;
                     }
@@ -5227,10 +5227,10 @@ private void pop() throws SAXException {
         node.release(this);
     }
 
-    private void popForeign(int origPos) throws SAXException {
-    	StackNode<T> node = stack[currentPtr];
-    	if (origPos != currentPtr) {
-            markMalformedIfScript(node.node);    		
+    private void popForeign(int origPos, int eltPos) throws SAXException {
+        StackNode<T> node = stack[currentPtr];
+        if (origPos != currentPtr || eltPos != currentPtr) {
+            markMalformedIfScript(node.node);
     	}
         assert debugOnlyClearLastStackSlot();
         currentPtr--;