Index: third_party/libxslt/libxslt/transform.c |
diff --git a/third_party/libxslt/libxslt/transform.c b/third_party/libxslt/libxslt/transform.c |
index 02bff34a09e957255dd8df6b480b28a5ff14202d..85ad3a20d41023ac558ddfd6bf4e04f70614cf40 100644 |
--- a/third_party/libxslt/libxslt/transform.c |
+++ b/third_party/libxslt/libxslt/transform.c |
@@ -2686,6 +2686,18 @@ xsltApplySequenceConstructor(xsltTransformContextPtr ctxt, |
"xsltApplySequenceConstructor: extension construct %s\n", |
cur->name)); |
#endif |
+ /* |
+ * Disable the xsltCopyTextString optimization for |
+ * extension elements. Extensions could append text using |
+ * xmlAddChild which will free the buffer pointed to by |
+ * 'lasttext'. This buffer could later be reallocated with |
+ * a different size than recorded in 'lasttsize'. See bug |
+ * #777432. |
+ */ |
+ if (cur->psvi == xsltExtMarker) { |
+ ctxt->lasttext = NULL; |
+ } |
+ |
ctxt->insert = insert; |
func(ctxt, contextNode, cur, cur->psvi); |
@@ -2869,6 +2881,18 @@ xsltApplySequenceConstructor(xsltTransformContextPtr ctxt, |
cur->name)); |
#endif |
+ /* |
+ * Disable the xsltCopyTextString optimization for |
+ * extension elements. Extensions could append text using |
+ * xmlAddChild which will free the buffer pointed to by |
+ * 'lasttext'. This buffer could later be reallocated with |
+ * a different size than recorded in 'lasttsize'. See bug |
+ * #777432. |
+ */ |
+ if (cur->psvi == xsltExtMarker) { |
+ ctxt->lasttext = NULL; |
+ } |
+ |
ctxt->insert = insert; |
function(ctxt, contextNode, cur, cur->psvi); |
@@ -5621,6 +5645,7 @@ typedef struct xsltHTMLVersion { |
} xsltHTMLVersion; |
static xsltHTMLVersion xsltHTMLVersions[] = { |
+ { "5", NULL, "about:legacy-compat" }, |
{ "4.01frame", "-//W3C//DTD HTML 4.01 Frameset//EN", |
"http://www.w3.org/TR/1999/REC-html401-19991224/frameset.dtd"}, |
{ "4.01strict", "-//W3C//DTD HTML 4.01//EN", |