Regression(r206240): XMLSerializer.serializeToString() does not properly escape '<' / '>' in attribute values
https://bugs.webkit.org/show_bug.cgi?id=171132
<rdar://problem/31426752>

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Re-sync web-platform-tests/domparsing from upstream.

* web-platform-tests/domparsing/DOMParser-parseFromString-html.html:
* web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html:
* web-platform-tests/domparsing/DOMParser-parseFromString-xml.html:
* web-platform-tests/domparsing/XMLSerializer-serializeToString.html:
* web-platform-tests/domparsing/createContextualFragment.html:
* web-platform-tests/domparsing/innerhtml-01.xhtml:
* web-platform-tests/domparsing/innerhtml-03.xhtml:
* web-platform-tests/domparsing/innerhtml-04.html:
* web-platform-tests/domparsing/innerhtml-05.xhtml:
* web-platform-tests/domparsing/innerhtml-06.html:
* web-platform-tests/domparsing/innerhtml-07.html:
* web-platform-tests/domparsing/insert-adjacent.html:
* web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml:
* web-platform-tests/domparsing/insert_adjacent_html.html:
* web-platform-tests/domparsing/outerhtml-01.html:
* web-platform-tests/domparsing/outerhtml-02.html:
* web-platform-tests/domparsing/style_attribute_html.html:
* web-platform-tests/domparsing/w3c-import.log:
* web-platform-tests/domparsing/xml-serialization.xhtml:

Source/WebCore:

Use XMLSerialization [1] in MarkupAccumulator::appendAttribute() when inXMLFragmentSerialization()
returns true, even if the node's associated document is an HTML document. When XMLSerializer.serializeToString()
is called on a Node, we want XML serialization, even if the node comes from an HTML document.

[1] https://w3c.github.io/DOM-Parsing/#dfn-xml-serialization

Test: fast/dom/XMLSerializer-serializeToString-entities.html

* editing/MarkupAccumulator.cpp:
(WebCore::MarkupAccumulator::appendAttributeValue):
(WebCore::MarkupAccumulator::appendAttribute):
* editing/MarkupAccumulator.h:

LayoutTests:

Add layout test coverage. This test is passing in both Firefox and Chrome.

* fast/dom/XMLSerializer-serializeToString-entities-expected.txt: Added.
* fast/dom/XMLSerializer-serializeToString-entities.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@215648 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 21d1c17..dea40b6 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,16 @@
+2017-04-21  Chris Dumez  <cdumez@apple.com>
+
+        Regression(r206240): XMLSerializer.serializeToString() does not properly escape '<' / '>' in attribute values
+        https://bugs.webkit.org/show_bug.cgi?id=171132
+        <rdar://problem/31426752>
+
+        Reviewed by Ryosuke Niwa.
+
+        Add layout test coverage. This test is passing in both Firefox and Chrome.
+
+        * fast/dom/XMLSerializer-serializeToString-entities-expected.txt: Added.
+        * fast/dom/XMLSerializer-serializeToString-entities.html: Added.
+
 2017-04-21  Youenn Fablet  <youenn@apple.com>
 
         [ios-simulator] LayoutTest webrtc/multi-video.html is a flaky crash
diff --git a/LayoutTests/fast/dom/XMLSerializer-serializeToString-entities-expected.txt b/LayoutTests/fast/dom/XMLSerializer-serializeToString-entities-expected.txt
new file mode 100644
index 0000000..45ab0d4
--- /dev/null
+++ b/LayoutTests/fast/dom/XMLSerializer-serializeToString-entities-expected.txt
@@ -0,0 +1,10 @@
+Tests that XMLSerializer.serializeToString() properly encodes entities in attribute values when the Element's associated document is an HTMLDocument.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS (new XMLSerializer()).serializeToString(node) is "<test xmlns=\"http://www.w3.org/1999/xhtml\" a=\"&lt;potato/&gt;\"></test>"
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/dom/XMLSerializer-serializeToString-entities.html b/LayoutTests/fast/dom/XMLSerializer-serializeToString-entities.html
new file mode 100644
index 0000000..c3ac9a1
--- /dev/null
+++ b/LayoutTests/fast/dom/XMLSerializer-serializeToString-entities.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script src="../../resources/js-test-pre.js"></script>
+<script>
+description("Tests that XMLSerializer.serializeToString() properly encodes entities in attribute values when the Element's associated document is an HTMLDocument.");
+const node = document.createElement("test");
+node.setAttribute("a", "<potato/>");
+shouldBeEqualToString('(new XMLSerializer()).serializeToString(node)', '<test xmlns="http://www.w3.org/1999/xhtml" a="&lt;potato/&gt;"></test>');
+</script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/imported/w3c/ChangeLog b/LayoutTests/imported/w3c/ChangeLog
index 97c81f5..19b65de 100644
--- a/LayoutTests/imported/w3c/ChangeLog
+++ b/LayoutTests/imported/w3c/ChangeLog
@@ -1,3 +1,33 @@
+2017-04-21  Chris Dumez  <cdumez@apple.com>
+
+        Regression(r206240): XMLSerializer.serializeToString() does not properly escape '<' / '>' in attribute values
+        https://bugs.webkit.org/show_bug.cgi?id=171132
+        <rdar://problem/31426752>
+
+        Reviewed by Ryosuke Niwa.
+
+        Re-sync web-platform-tests/domparsing from upstream.
+
+        * web-platform-tests/domparsing/DOMParser-parseFromString-html.html:
+        * web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html:
+        * web-platform-tests/domparsing/DOMParser-parseFromString-xml.html:
+        * web-platform-tests/domparsing/XMLSerializer-serializeToString.html:
+        * web-platform-tests/domparsing/createContextualFragment.html:
+        * web-platform-tests/domparsing/innerhtml-01.xhtml:
+        * web-platform-tests/domparsing/innerhtml-03.xhtml:
+        * web-platform-tests/domparsing/innerhtml-04.html:
+        * web-platform-tests/domparsing/innerhtml-05.xhtml:
+        * web-platform-tests/domparsing/innerhtml-06.html:
+        * web-platform-tests/domparsing/innerhtml-07.html:
+        * web-platform-tests/domparsing/insert-adjacent.html:
+        * web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml:
+        * web-platform-tests/domparsing/insert_adjacent_html.html:
+        * web-platform-tests/domparsing/outerhtml-01.html:
+        * web-platform-tests/domparsing/outerhtml-02.html:
+        * web-platform-tests/domparsing/style_attribute_html.html:
+        * web-platform-tests/domparsing/w3c-import.log:
+        * web-platform-tests/domparsing/xml-serialization.xhtml:
+
 2017-04-19  Ryan Haddad  <ryanhaddad@apple.com>
 
         Remove two tests after r215515.
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-html.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-html.html
index ec42442..3081f9a 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-html.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-html.html
@@ -1,7 +1,7 @@
 <!doctype html>
 <title>DOMParser basic test of HTML parsing</title>
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
 <script>
 // |expected| should be an object indicating the expected type of node.
 function assert_node(actual, expected) {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html
index cd655ac..52261f2 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html
@@ -2,8 +2,8 @@
 <meta charset=utf-8>
 <title>HTML entities for various XHTML Doctype variants</title>
 <link rel=help href="http://w3c.github.io/html/xhtml.html#parsing-xhtml-documents">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
 <div id="log"></div>
 <script>
   test(function () {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml.html
index c639c23..1090c76 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml.html
@@ -1,8 +1,8 @@
 <!DOCTYPE html>
 <title>DOMParser</title>
 <link rel="author" title="Ms2ger" href="mailto:ms2ger@gmail.com">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
 <div id="log"></div>
 <script>
 function checkMetadata(doc, contentType) {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/XMLSerializer-serializeToString.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/XMLSerializer-serializeToString.html
index 60932ee..4a7627a 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/XMLSerializer-serializeToString.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/XMLSerializer-serializeToString.html
@@ -3,8 +3,8 @@
 <html>
  <head>
   <title>domparsing Test: XMLSerializer.serializeToString</title>
-  <script src="/resources/testharness.js"></script>
-  <script src="/resources/testharnessreport.js"></script>
+  <script src="../../../../resources/testharness.js"></script>
+  <script src="../../../../resources/testharnessreport.js"></script>
  </head>
  <body>
     <h1>domparsing_XMLSerializer_serializeToString</h1>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/createContextualFragment.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/createContextualFragment.html
index a885a5d..b1ac321 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/createContextualFragment.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/createContextualFragment.html
@@ -1,8 +1,8 @@
 <!doctype html>
 <title>createContextualFragment() tests</title>
 <div id=log></div>
-<script src=/resources/testharness.js></script>
-<script src=/resources/testharnessreport.js></script>
+<script src=../../../../resources/testharness.js></script>
+<script src=../../../../resources/testharnessreport.js></script>
 <script>
 // We are not testing XML documents here, because apparently it's not clear
 // what we want to happen there.  We also aren't testing the HTML parser in any
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-01.xhtml b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-01.xhtml
index 432cfbf..38da5e5 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-01.xhtml
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-01.xhtml
@@ -5,8 +5,8 @@
 <link rel="help" href="https://w3c.github.io/DOM-Parsing/#widl-Element-innerHTML"/>
 <link rel="help" href="http://www.whatwg.org/html5/#xml-fragment-serialization-algorithm"/>
 <link rel="help" href="http://www.whatwg.org/html5/#document.title"/>
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
 </head>
 <body>
 <div id="log"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-03.xhtml b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-03.xhtml
index 313531e..c704ddd 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-03.xhtml
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-03.xhtml
@@ -5,8 +5,8 @@
 <link rel="author" title="Ms2ger" href="mailto:ms2ger@gmail.com"/>
 <link rel="help" href="http://html5.org/specs/dom-parsing.html#dom-innerhtml"/>
 <link rel="help" href="http://www.whatwg.org/html5/#xml-fragment-serialization-algorithm"/>
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
 </head>
 <body>
 <div id="log"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-04.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-04.html
index 32c921d..24061bf 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-04.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-04.html
@@ -2,8 +2,8 @@
 <title>innerHTML in HTML</title>
 <link rel="author" title="Ms2ger" href="mailto:ms2ger@gmail.com">
 <link rel="help" href="https://w3c.github.io/DOM-Parsing/#widl-Element-innerHTML">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
 <div id="log"></div>
 <script>
 function testIsChild(p, c) {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-05.xhtml b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-05.xhtml
index da2d851..10eef36 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-05.xhtml
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-05.xhtml
@@ -5,8 +5,8 @@
 <link rel="author" title="Ms2ger" href="mailto:ms2ger@gmail.com"/>
 <link rel="help" href="http://html5.org/specs/dom-parsing.html#dom-innerhtml"/>
 <link rel="help" href="http://www.whatwg.org/html5/#xml-fragment-serialization-algorithm"/>
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
 </head>
 <body>
 <div id="log"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-06.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-06.html
index 81e9c57..735b032c 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-06.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-06.html
@@ -2,8 +2,8 @@
 <html>
 <head>
 <title>math in html: innerHTML</title>
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
 </head>
 <body>
 <h1>math in html: innerHTML</h1>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-07.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-07.html
index 9e313a2..79ea04b 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-07.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-07.html
@@ -2,8 +2,8 @@
 <title>innerHTML and string conversion</title>
 <link rel="author" title="Ms2ger" href="mailto:ms2ger@gmail.com">
 <link rel="help" href="http://domparsing.spec.whatwg.org/#extensions-to-the-element-interface">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
 <div id="log"></div>
 <script>
 test(function() {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert-adjacent.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert-adjacent.html
index f43ec40..02cdf3a 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert-adjacent.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert-adjacent.html
@@ -1,7 +1,7 @@
 <!doctype html>
 <title>insertAdjacentHTML</title>
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
 <style>
 #element {
   display: none;
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml b/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml
index eadf10e..8e2f4af 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml
@@ -1,8 +1,8 @@
 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
   <title>insertAdjacentHTML in HTML</title>
-  <script src="/resources/testharness.js"></script>
-  <script src="/resources/testharnessreport.js"></script>
+  <script src="../../../../resources/testharness.js"></script>
+  <script src="../../../../resources/testharnessreport.js"></script>
   <script src="insert_adjacent_html.js"></script>
 </head>
 <body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html.html
index dfe624f..3c4468d 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html.html
@@ -2,8 +2,8 @@
 <html>
 <head>
   <title>insertAdjacentHTML in HTML</title>
-  <script src="/resources/testharness.js"></script>
-  <script src="/resources/testharnessreport.js"></script>
+  <script src="../../../../resources/testharness.js"></script>
+  <script src="../../../../resources/testharnessreport.js"></script>
   <script src="insert_adjacent_html.js"></script>
 </head>
 <body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-01.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-01.html
index 2e8072e..8492232 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-01.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-01.html
@@ -2,8 +2,8 @@
 <title>outerHTML: child of #document</title>
 <link rel="author" title="Ms2ger" href="mailto:ms2ger@gmail.com">
 <link rel="help" href="http://html5.org/specs/dom-parsing.html#outerhtml">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
 <div id="log"></div>
 <script>
 test(function() {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-02.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-02.html
index 7b69fbf..abd19e3 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-02.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-02.html
@@ -2,8 +2,8 @@
 <title>outerHTML and string conversion</title>
 <link rel="author" title="Ms2ger" href="mailto:ms2ger@gmail.com">
 <link rel="help" href="http://domparsing.spec.whatwg.org/#extensions-to-the-element-interface">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
 <div id="log"></div>
 <script>
 test(function() {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/style_attribute_html.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/style_attribute_html.html
index f7f057d..aba4f2e 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/style_attribute_html.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/style_attribute_html.html
@@ -1,8 +1,8 @@
 <!doctype html>
 <meta charset=utf-8>
 <title>Style attribute in HTML</title>
-<script src=/resources/testharness.js></script>
-<script src=/resources/testharnessreport.js></script>
+<script src=../../../../resources/testharness.js></script>
+<script src=../../../../resources/testharnessreport.js></script>
 <script>
 
 var div;
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/domparsing/w3c-import.log
index 3611552..e507a88 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/w3c-import.log
@@ -16,7 +16,10 @@
 ------------------------------------------------------------------------
 List of files:
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-html.html
+/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html
+/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml.html
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/OWNERS
+/LayoutTests/imported/w3c/web-platform-tests/domparsing/XMLSerializer-serializeToString.html
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/createContextualFragment.html
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-01.xhtml
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-03.xhtml
@@ -25,8 +28,10 @@
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-06.html
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-07.html
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/insert-adjacent.html
+/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html.html
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html.js
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-01.html
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-02.html
+/LayoutTests/imported/w3c/web-platform-tests/domparsing/style_attribute_html.html
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/xml-serialization.xhtml
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/xml-serialization.xhtml b/LayoutTests/imported/w3c/web-platform-tests/domparsing/xml-serialization.xhtml
index 678523d..eac8a79 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/xml-serialization.xhtml
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/xml-serialization.xhtml
@@ -1,8 +1,8 @@
 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
   <title>XML serialization</title>
-  <script src="/resources/testharness.js"></script>
-  <script src="/resources/testharnessreport.js"></script>
+  <script src="../../../../resources/testharness.js"></script>
+  <script src="../../../../resources/testharnessreport.js"></script>
 </head>
 <body>
 <div id="log"></div>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index be2f33d..ace8c3d 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,24 @@
+2017-04-21  Chris Dumez  <cdumez@apple.com>
+
+        Regression(r206240): XMLSerializer.serializeToString() does not properly escape '<' / '>' in attribute values
+        https://bugs.webkit.org/show_bug.cgi?id=171132
+        <rdar://problem/31426752>
+
+        Reviewed by Ryosuke Niwa.
+
+        Use XMLSerialization [1] in MarkupAccumulator::appendAttribute() when inXMLFragmentSerialization()
+        returns true, even if the node's associated document is an HTML document. When XMLSerializer.serializeToString()
+        is called on a Node, we want XML serialization, even if the node comes from an HTML document.
+
+        [1] https://w3c.github.io/DOM-Parsing/#dfn-xml-serialization
+
+        Test: fast/dom/XMLSerializer-serializeToString-entities.html
+
+        * editing/MarkupAccumulator.cpp:
+        (WebCore::MarkupAccumulator::appendAttributeValue):
+        (WebCore::MarkupAccumulator::appendAttribute):
+        * editing/MarkupAccumulator.h:
+
 2017-04-20  Sam Weinig  <sam@webkit.org>
 
         Split cryptographic digest computation and parsing out of CSP code so it can be reused
diff --git a/Source/WebCore/editing/MarkupAccumulator.cpp b/Source/WebCore/editing/MarkupAccumulator.cpp
index efc4517..d3bb0af 100644
--- a/Source/WebCore/editing/MarkupAccumulator.cpp
+++ b/Source/WebCore/editing/MarkupAccumulator.cpp
@@ -214,10 +214,10 @@
     result.append(m_markup);
 }
 
-void MarkupAccumulator::appendAttributeValue(StringBuilder& result, const String& attribute, bool documentIsHTML)
+void MarkupAccumulator::appendAttributeValue(StringBuilder& result, const String& attribute, bool isSerializingHTML)
 {
     appendCharactersReplacingEntities(result, attribute, 0, attribute.length(),
-        documentIsHTML ? EntityMaskInHTMLAttributeValue : EntityMaskInAttributeValue);
+        isSerializingHTML ? EntityMaskInHTMLAttributeValue : EntityMaskInAttributeValue);
 }
 
 void MarkupAccumulator::appendCustomAttributes(StringBuilder&, const Element&, Namespaces*)
@@ -489,12 +489,12 @@
 
 void MarkupAccumulator::appendAttribute(StringBuilder& result, const Element& element, const Attribute& attribute, Namespaces* namespaces)
 {
-    bool documentIsHTML = element.document().isHTMLDocument();
+    bool isSerializingHTML = element.document().isHTMLDocument() && !inXMLFragmentSerialization();
 
     result.append(' ');
 
     QualifiedName prefixedName = attribute.name();
-    if (documentIsHTML && !attributeIsInSerializedNamespace(attribute))
+    if (isSerializingHTML && !attributeIsInSerializedNamespace(attribute))
         result.append(attribute.name().localName());
     else {
         if (!attribute.namespaceURI().isEmpty()) {
@@ -524,11 +524,11 @@
         appendQuotedURLAttributeValue(result, element, attribute);
     else {
         result.append('"');
-        appendAttributeValue(result, attribute.value(), documentIsHTML);
+        appendAttributeValue(result, attribute.value(), isSerializingHTML);
         result.append('"');
     }
 
-    if ((inXMLFragmentSerialization() || !documentIsHTML) && namespaces && shouldAddNamespaceAttribute(attribute, *namespaces))
+    if (!isSerializingHTML && namespaces && shouldAddNamespaceAttribute(attribute, *namespaces))
         appendNamespace(result, prefixedName.prefix(), prefixedName.namespaceURI(), *namespaces);
 }
 
diff --git a/Source/WebCore/editing/MarkupAccumulator.h b/Source/WebCore/editing/MarkupAccumulator.h
index 7f78b88..38b73c6 100644
--- a/Source/WebCore/editing/MarkupAccumulator.h
+++ b/Source/WebCore/editing/MarkupAccumulator.h
@@ -92,7 +92,7 @@
     void appendStartMarkup(StringBuilder&, const Node&, Namespaces*);
     void appendEndMarkup(StringBuilder&, const Element&);
 
-    void appendAttributeValue(StringBuilder&, const String&, bool);
+    void appendAttributeValue(StringBuilder&, const String&, bool isSerializingHTML);
     void appendNamespace(StringBuilder&, const AtomicString& prefix, const AtomicString& namespaceURI, Namespaces&, bool allowEmptyDefaultNS = false);
     void appendXMLDeclaration(StringBuilder&, const Document&);
     void appendDocumentType(StringBuilder&, const DocumentType&);