Bug 1883804 - Only unescape ASCII chars in IDTracker::ResetWithLocalRef. r=longsonr

Differential Revision: https://phabricator.services.mozilla.com/D205039

dom/base/IDTracker.cpp

@@ -143,8 +143,19 @@ void IDTracker::ResetWithLocalRef(Element& aFrom, const nsAString& aLocalRef,
     Unlink();
     return;
   }
-  NS_UnescapeURL(utf8Ref);
-  RefPtr<nsAtom> idAtom = NS_Atomize(utf8Ref);
+
+  // Only unescape ASCII characters; if we were to unescape arbitrary bytes,
+  // we'd potentially end up with invalid UTF-8.
+  nsAutoCString unescaped;
+  bool appended;
+  if (NS_FAILED(NS_UnescapeURL(utf8Ref.BeginReading(), utf8Ref.Length(),
+                               esc_OnlyASCII | esc_AlwaysCopy, unescaped,
+                               appended, mozilla::fallible))) {
+    Unlink();
+    return;
+  }
+
+  RefPtr<nsAtom> idAtom = NS_Atomize(unescaped);
   ResetWithID(aFrom, idAtom, aWatch);
 }
 

testing/web-platform/tests/svg/crashtests/firefox-bug-1883804.html

@@ -0,0 +1,3 @@
+<svg>
+<set xlink:href="#)󠵵‏᭭%a8*=٫́壎
+<title class="
>