XMLSerializer escapes < > & correctly inside <script> and <style> tags.

Source/core/editing/MarkupAccumulator.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2009, 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 285 matching lines @@
 
         result.append('=');
         result.append('"');
         appendAttributeValue(result, namespaceURI, false);
         result.append('"');
     }
 }
 
 EntityMask MarkupAccumulator::entityMaskForText(Text* text) const
 {
+    if (!text->document().isHTMLDocument())
+        return EntityMaskInPCDATA;
+
     const QualifiedName* parentName = 0;
     if (text->parentElement())
         parentName = &(text->parentElement())->tagQName();
 
     if (parentName && (*parentName == scriptTag || *parentName == styleTag || *parentName == xmpTag))
         return EntityMaskInCDATA;
-
-    return text->document().isHTMLDocument() ? EntityMaskInHTMLPCDATA : EntityMaskInPCDATA;
+    return EntityMaskInHTMLPCDATA;
 }
 
 void MarkupAccumulator::appendText(StringBuilder& result, Text* text)
 {
     appendNodeValue(result, text, m_range, entityMaskForText(text));
 }
 
 void MarkupAccumulator::appendComment(StringBuilder& result, const String& comment)
 {
     // FIXME: Comment content is not escaped, but XMLSerializer (and possibly other callers) should raise an exception if it includes "-->".
@@ skipping 222 matching lines @@
     if (!node->isElementNode() || shouldSelfClose(node) || (!node->hasChildNodes() && elementCannotHaveEndTag(node)))
         return;
 
     result.append('<');
     result.append('/');
     result.append(toElement(node)->nodeNamePreservingCase());
     result.append('>');
 }
 
 }