Considering HTMLTokenizer state in HTMLSourceTracker

third_party/WebKit/Source/core/html/parser/HTMLSourceTracker.cpp

 /*
  * Copyright (C) 2010 Adam Barth. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 19 matching lines @@
 
 namespace blink {
 
 HTMLSourceTracker::HTMLSourceTracker() : m_isStarted(false) {}
 
 void HTMLSourceTracker::start(SegmentedString& currentInput,
                               HTMLTokenizer* tokenizer,
                               HTMLToken& token) {
   if (token.type() == HTMLToken::Uninitialized && !m_isStarted) {
     m_previousSource.clear();
-    if (tokenizer->numberOfBufferedCharacters())
+    if (needToCheckTokenizerBuffer(tokenizer) &&
+        tokenizer->numberOfBufferedCharacters())
       m_previousSource = tokenizer->bufferedCharacters();
-  } else
+  } else {
     m_previousSource.append(m_currentSource);
+  }
 
   m_isStarted = true;
   m_currentSource = currentInput;
   token.setBaseOffset(m_currentSource.numberOfCharactersConsumed() -
                       m_previousSource.length());
 }
 
 void HTMLSourceTracker::end(SegmentedString& currentInput,
                             HTMLTokenizer* tokenizer,
                             HTMLToken& token) {
   m_isStarted = false;
 
   m_cachedSourceForToken = String();
 
   // FIXME: This work should really be done by the HTMLTokenizer.
+  size_t numberOfBufferedCharacters = 0u;
+  if (needToCheckTokenizerBuffer(tokenizer)) {
+    numberOfBufferedCharacters = tokenizer->numberOfBufferedCharacters();
+  }
   token.end(currentInput.numberOfCharactersConsumed() -
-            tokenizer->numberOfBufferedCharacters());
+            numberOfBufferedCharacters);
 }
 
 String HTMLSourceTracker::sourceForToken(const HTMLToken& token) {
   if (!m_cachedSourceForToken.isEmpty())
     return m_cachedSourceForToken;
 
   size_t length;
   if (token.type() == HTMLToken::EndOfFile) {
     // Consume the remainder of the input, omitting the null character we use to
     // mark the end of the file.
@@ skipping 14 matching lines @@
   for (; i < length; ++i) {
     ASSERT(!m_currentSource.isEmpty());
     source.append(m_currentSource.currentChar());
     m_currentSource.advance();
   }
 
   m_cachedSourceForToken = source.toString();
   return m_cachedSourceForToken;
 }
 
+bool HTMLSourceTracker::needToCheckTokenizerBuffer(HTMLTokenizer* tokenizer) {
+  HTMLTokenizer::State state = tokenizer->getState();
+  // The temporary buffer must not be used unconditionally, because in some
+  // states (e.g. ScriptDataDoubleEscapedStartState), data is appended to
+  // both the temporary buffer and the token itself.
+  return state == HTMLTokenizer::DataState ||
+         HTMLTokenizer::isEndTagBufferingState(state);
+}
+
 }  // namespace blink