Mozilla bug 1515066 - Mark SVG script without an end tag malformed. r=smaug.

Author: hsivonen

src/nu/validator/htmlparser/impl/TreeBuilder.java

@@ -3360,14 +3360,15 @@ public final void endTag(ElementName elementName) throws SAXException {
                     }
                 }
                 eltPos = currentPtr;
+                int origPos = currentPtr;
                 for (;;) {
                     if (eltPos == 0) {
                         assert fragment: "We can get this close to the root of the stack in foreign content only in the fragment case.";
                         break endtagloop;
                     }
                     if (stack[eltPos].name == name) {
                         while (currentPtr >= eltPos) {
-                            pop();
+                            popForeign(origPos);
                         }
                         break endtagloop;
                     }
@@ -5226,6 +5227,17 @@ private void pop() throws SAXException {
         node.release(this);
     }
 
+    private void popForeign(int origPos) throws SAXException {
+    	StackNode<T> node = stack[currentPtr];
+    	if (origPos != currentPtr) {
+            markMalformedIfScript(node.node);    		
+    	}
+        assert debugOnlyClearLastStackSlot();
+        currentPtr--;
+        elementPopped(node.ns, node.popName, node.node);
+        node.release(this);
+    }
+
     private void silentPop() throws SAXException {
         StackNode<T> node = stack[currentPtr];
         assert debugOnlyClearLastStackSlot();