| Index: third_party/libxslt/libxslt/transform.c
|
| diff --git a/third_party/libxslt/libxslt/transform.c b/third_party/libxslt/libxslt/transform.c
|
| index 02bff34a09e957255dd8df6b480b28a5ff14202d..85ad3a20d41023ac558ddfd6bf4e04f70614cf40 100644
|
| --- a/third_party/libxslt/libxslt/transform.c
|
| +++ b/third_party/libxslt/libxslt/transform.c
|
| @@ -2686,6 +2686,18 @@ xsltApplySequenceConstructor(xsltTransformContextPtr ctxt,
|
| "xsltApplySequenceConstructor: extension construct %s\n",
|
| cur->name));
|
| #endif
|
| + /*
|
| + * Disable the xsltCopyTextString optimization for
|
| + * extension elements. Extensions could append text using
|
| + * xmlAddChild which will free the buffer pointed to by
|
| + * 'lasttext'. This buffer could later be reallocated with
|
| + * a different size than recorded in 'lasttsize'. See bug
|
| + * #777432.
|
| + */
|
| + if (cur->psvi == xsltExtMarker) {
|
| + ctxt->lasttext = NULL;
|
| + }
|
| +
|
| ctxt->insert = insert;
|
|
|
| func(ctxt, contextNode, cur, cur->psvi);
|
| @@ -2869,6 +2881,18 @@ xsltApplySequenceConstructor(xsltTransformContextPtr ctxt,
|
| cur->name));
|
| #endif
|
|
|
| + /*
|
| + * Disable the xsltCopyTextString optimization for
|
| + * extension elements. Extensions could append text using
|
| + * xmlAddChild which will free the buffer pointed to by
|
| + * 'lasttext'. This buffer could later be reallocated with
|
| + * a different size than recorded in 'lasttsize'. See bug
|
| + * #777432.
|
| + */
|
| + if (cur->psvi == xsltExtMarker) {
|
| + ctxt->lasttext = NULL;
|
| + }
|
| +
|
| ctxt->insert = insert;
|
|
|
| function(ctxt, contextNode, cur, cur->psvi);
|
| @@ -5621,6 +5645,7 @@ typedef struct xsltHTMLVersion {
|
| } xsltHTMLVersion;
|
|
|
| static xsltHTMLVersion xsltHTMLVersions[] = {
|
| + { "5", NULL, "about:legacy-compat" },
|
| { "4.01frame", "-//W3C//DTD HTML 4.01 Frameset//EN",
|
| "http://www.w3.org/TR/1999/REC-html401-19991224/frameset.dtd"},
|
| { "4.01strict", "-//W3C//DTD HTML 4.01//EN",
|
|
|