Properly simulate self-closing tags when in "foreign content" mode

third_party/WebKit/Source/core/html/parser/HTMLTreeBuilderSimulator.cpp

 /*
  * Copyright (C) 2013 Google, Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 140 matching lines @@
                  (threadSafeMatch(tagName, noembedTag) &&
                   m_options.pluginsEnabled) ||
                  threadSafeMatch(tagName, noframesTag) ||
                  (threadSafeMatch(tagName, noscriptTag) &&
                   m_options.scriptEnabled)) {
         tokenizer->setState(HTMLTokenizer::RAWTEXTState);
       }
     }
   }
 
-  if (token.type() == HTMLToken::EndTag) {
+  if (token.type() == HTMLToken::EndTag ||
+      (token.selfClosing() && token.type() == HTMLToken::StartTag &&
+       inForeignContent())) {
     const String& tagName = token.data();
     if ((m_namespaceStack.back() == SVG &&
          threadSafeMatch(tagName, SVGNames::svgTag)) ||
         (m_namespaceStack.back() == MathML &&
          threadSafeMatch(tagName, MathMLNames::mathTag)) ||
         (m_namespaceStack.contains(SVG) && m_namespaceStack.back() == HTML &&
          tokenExitsSVG(token)) ||
         (m_namespaceStack.contains(MathML) && m_namespaceStack.back() == HTML &&
          tokenExitsMath(token)))
       m_namespaceStack.pop_back();
     if (threadSafeMatch(tagName, scriptTag)) {
       if (!inForeignContent())
         tokenizer->setState(HTMLTokenizer::DataState);
       return ScriptEnd;
     }
   }
 
   // FIXME: Also setForceNullCharacterReplacement when in text mode.
   tokenizer->setForceNullCharacterReplacement(inForeignContent());
   tokenizer->setShouldAllowCDATA(inForeignContent());
   return simulatedToken;
 }
 
 }  // namespace blink