Bug 982285 - Update active formatting element list indices in HTML parser adoption agency algorithm. r=hsivonen

parser/html/javasrc/TreeBuilder.java

@@ -4576,7 +4576,7 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                 stack[currentPtr].name == name &&
                 findInListOfActiveFormattingElements(stack[currentPtr]) == -1) {
             // If the current element matches the name but isn't on the list of active
-            // formatting elements, then it is possible that the list was mangled by the Noah's Arc
+            // formatting elements, then it is possible that the list was mangled by the Noah's Ark
             // clause. In this case, we want to match the end tag against the stack instead of
             // proceeding with the AAA algorithm that may match against the list of
             // active formatting elements (and possibly mangle the tree in unexpected ways).
@@ -4661,6 +4661,16 @@ public abstract class TreeBuilder<T> implements TokenHandler,
 
                 if (j > 3 && nodeListPos != -1) {
                     removeFromListOfActiveFormattingElements(nodeListPos);
+
+                    // Adjust the indices into the list to account
+                    // for the removal of nodeListPos.
+                    if (nodeListPos <= formattingEltListPos) {
+                        formattingEltListPos--;
+                    }
+                    if (nodeListPos <= bookmark) {
+                        bookmark--;
+                    }
+
                     // Update position to reflect removal from list.
                     nodeListPos = -1;
                 }

parser/html/nsHtml5TreeBuilder.cpp

@@ -3575,6 +3575,12 @@ nsHtml5TreeBuilder::adoptionAgencyEndTag(nsIAtom* name)
       int32_t nodeListPos = findInListOfActiveFormattingElements(node);
       if (j > 3 && nodeListPos != -1) {
         removeFromListOfActiveFormattingElements(nodeListPos);
+        if (nodeListPos <= formattingEltListPos) {
+          formattingEltListPos--;
+        }
+        if (nodeListPos <= bookmark) {
+          bookmark--;
+        }
         nodeListPos = -1;
       }
       if (nodeListPos == -1) {

parser/htmlparser/tests/crashtests/982285-1.html

@@ -0,0 +1,19 @@
+<q>
+<u>
+<pre>
+<pre>
+<center>
+<em>
+<center>
+<center>
+</rp>
+<address>
+<address>
+<address>
+</rt>
+<q>
+<q>
+<rt>
+</u>
+<pre>
+</em>

parser/htmlparser/tests/crashtests/crashtests.list

@@ -54,3 +54,4 @@ load view-source:699347-1.xml
 load 721313-1.html
 load view-source:742414-1.html
 load 981279-1.html
+load 982285-1.html