Regression(r206240): XMLSerializer.serializeToString() does not properly escape '<' / '>' in attribute values
https://bugs.webkit.org/show_bug.cgi?id=171132
<rdar://problem/31426752>

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Re-sync web-platform-tests/domparsing from upstream.

* web-platform-tests/domparsing/DOMParser-parseFromString-html.html:
* web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html:
* web-platform-tests/domparsing/DOMParser-parseFromString-xml.html:
* web-platform-tests/domparsing/XMLSerializer-serializeToString.html:
* web-platform-tests/domparsing/createContextualFragment.html:
* web-platform-tests/domparsing/innerhtml-01.xhtml:
* web-platform-tests/domparsing/innerhtml-03.xhtml:
* web-platform-tests/domparsing/innerhtml-04.html:
* web-platform-tests/domparsing/innerhtml-05.xhtml:
* web-platform-tests/domparsing/innerhtml-06.html:
* web-platform-tests/domparsing/innerhtml-07.html:
* web-platform-tests/domparsing/insert-adjacent.html:
* web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml:
* web-platform-tests/domparsing/insert_adjacent_html.html:
* web-platform-tests/domparsing/outerhtml-01.html:
* web-platform-tests/domparsing/outerhtml-02.html:
* web-platform-tests/domparsing/style_attribute_html.html:
* web-platform-tests/domparsing/w3c-import.log:
* web-platform-tests/domparsing/xml-serialization.xhtml:

Source/WebCore:

Use XMLSerialization [1] in MarkupAccumulator::appendAttribute() when inXMLFragmentSerialization()
returns true, even if the node's associated document is an HTML document. When XMLSerializer.serializeToString()
is called on a Node, we want XML serialization, even if the node comes from an HTML document.

[1] https://w3c.github.io/DOM-Parsing/#dfn-xml-serialization

Test: fast/dom/XMLSerializer-serializeToString-entities.html

* editing/MarkupAccumulator.cpp:
(WebCore::MarkupAccumulator::appendAttributeValue):
(WebCore::MarkupAccumulator::appendAttribute):
* editing/MarkupAccumulator.h:

LayoutTests:

Add layout test coverage. This test is passing in both Firefox and Chrome.

* fast/dom/XMLSerializer-serializeToString-entities-expected.txt: Added.
* fast/dom/XMLSerializer-serializeToString-entities.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@215648 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 21d1c17..dea40b6 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,16 @@
+2017-04-21  Chris Dumez  <cdumez@apple.com>
+
+        Regression(r206240): XMLSerializer.serializeToString() does not properly escape '<' / '>' in attribute values
+        https://bugs.webkit.org/show_bug.cgi?id=171132
+        <rdar://problem/31426752>
+
+        Reviewed by Ryosuke Niwa.
+
+        Add layout test coverage. This test is passing in both Firefox and Chrome.
+
+        * fast/dom/XMLSerializer-serializeToString-entities-expected.txt: Added.
+        * fast/dom/XMLSerializer-serializeToString-entities.html: Added.
+
 2017-04-21  Youenn Fablet  <youenn@apple.com>
 
         [ios-simulator] LayoutTest webrtc/multi-video.html is a flaky crash