From 1848152646b01e7e74198beb67b3912808c96de4 Mon Sep 17 00:00:00 2001
From: "Michael[tm] Smith" <mike@w3.org>
Date: Thu, 2 Jul 2020 15:32:11 +0300
Subject: [PATCH] Bug 1319410 - Make consecutive hyphens in comments a
 non-error

Also allow `<!-->` at (IE conditional) comment end

See https://github.com/whatwg/html/pull/1356
See https://github.com/whatwg/html/pull/1456

Differential Revision: https://phabricator.services.mozilla.com/D82000
---
 .../en-US/chrome/layout/htmlparser.properties |   2 +-
 parser/html/javasrc/Tokenizer.java            | 199 ++++++++++++-
 parser/html/nsHtml5Tokenizer.cpp              | 267 +++++++++++++++++-
 parser/html/nsHtml5Tokenizer.h                |  16 +-
 parser/html/nsHtml5TokenizerCppSupplement.h   |   4 +-
 parser/html/nsHtml5TokenizerHSupplement.h     |   2 +-
 6 files changed, 462 insertions(+), 28 deletions(-)

diff --git a/dom/locales/en-US/chrome/layout/htmlparser.properties b/dom/locales/en-US/chrome/layout/htmlparser.properties
index 36636b0c942b3..655177a7b4d2c 100644
--- a/dom/locales/en-US/chrome/layout/htmlparser.properties
+++ b/dom/locales/en-US/chrome/layout/htmlparser.properties
@@ -76,7 +76,7 @@ errDuplicateAttribute=Duplicate attribute.
 errEofInSystemId=End of file inside system identifier.
 errExpectedSystemId=Expected a system identifier but the doctype ended.
 errMissingSpaceBeforeDoctypeName=Missing space before doctype name.
-errHyphenHyphenBang=“--!” found in comment.
+errNestedComment=Saw “<!--” within a comment. Probable cause: Nested comment (not allowed).
 errNcrZero=Character reference expands to zero.
 errNoSpaceBetweenDoctypeSystemKeywordAndQuote=No space between the doctype “SYSTEM” keyword and the quote.
 errNoSpaceBetweenPublicAndSystemIds=No space between the doctype public and system identifiers.
diff --git a/parser/html/javasrc/Tokenizer.java b/parser/html/javasrc/Tokenizer.java
index 546497e94d102..8f92edd04cd6b 100644
--- a/parser/html/javasrc/Tokenizer.java
+++ b/parser/html/javasrc/Tokenizer.java
@@ -222,6 +222,14 @@ public class Tokenizer implements Locator {
 
     public static final int AMBIGUOUS_AMPERSAND = 75;
 
+    public static final int COMMENT_LESSTHAN = 76;
+
+    public static final int COMMENT_LESSTHAN_BANG = 77;
+
+    public static final int COMMENT_LESSTHAN_BANG_DASH = 78;
+
+    public static final int COMMENT_LESSTHAN_BANG_DASH_DASH = 79;
+
     /**
      * Magic value for UTF-16 operations.
      */
@@ -1034,9 +1042,8 @@ private void maybeAppendSpaceToBogusComment() throws SAXException {
 
     // ]NOCPP]
 
-    @Inline private void adjustDoubleHyphenAndAppendToStrBufAndErr(char c)
+    @Inline private void adjustDoubleHyphenAndAppendToStrBufAndErr(char c, boolean reportedConsecutiveHyphens)
             throws SAXException {
-        errConsecutiveHyphens();
         // [NOCPP[
         switch (commentPolicy) {
             case ALTER_INFOSET:
@@ -1047,7 +1054,9 @@ private void maybeAppendSpaceToBogusComment() throws SAXException {
                 appendStrBuf('-');
                 // CPPONLY: MOZ_FALLTHROUGH;
             case ALLOW:
-                warn("The document is not mappable to XML 1.0 due to two consecutive hyphens in a comment.");
+                if (!reportedConsecutiveHyphens) {
+                    warn("The document is not mappable to XML 1.0 due to two consecutive hyphens in a comment.");
+                }
                 // ]NOCPP]
                 appendStrBuf(c);
                 // [NOCPP[
@@ -1509,6 +1518,7 @@ private void ensureBufferSpace(int inputLength) throws SAXException {
     @SuppressWarnings("unused") private int stateLoop(int state, char c,
             int pos, @NoLength char[] buf, boolean reconsume, int returnState,
             int endPos) throws SAXException {
+        boolean reportedConsecutiveHyphens = false;
         /*
          * Idioms used in this code:
          *
@@ -2594,6 +2604,7 @@ private void ensureBufferSpace(int inputLength) throws SAXException {
                     }
                     // CPPONLY: MOZ_FALLTHROUGH;
                 case COMMENT_START:
+                    reportedConsecutiveHyphens = false;
                     commentstartloop: for (;;) {
                         if (++pos == endPos) {
                             break stateloop;
@@ -2626,6 +2637,10 @@ private void ensureBufferSpace(int inputLength) throws SAXException {
                                  */
                                 state = transition(state, Tokenizer.DATA, reconsume, pos);
                                 continue stateloop;
+                            case '<':
+                                appendStrBuf(c);
+                                state = transition(state, Tokenizer.COMMENT_LESSTHAN, reconsume, pos);
+                                continue stateloop;
                             case '\r':
                                 appendStrBufCarriageReturn();
                                 state = transition(state, Tokenizer.COMMENT, reconsume, pos);
@@ -2671,6 +2686,10 @@ private void ensureBufferSpace(int inputLength) throws SAXException {
                                 state = transition(state, Tokenizer.COMMENT_END_DASH, reconsume, pos);
                                 break commentloop;
                             // continue stateloop;
+                            case '<':
+                                appendStrBuf(c);
+                                state = transition(state, Tokenizer.COMMENT_LESSTHAN, reconsume, pos);
+                                continue stateloop;
                             case '\r':
                                 appendStrBufCarriageReturn();
                                 break stateloop;
@@ -2713,6 +2732,10 @@ private void ensureBufferSpace(int inputLength) throws SAXException {
                                 state = transition(state, Tokenizer.COMMENT_END, reconsume, pos);
                                 break commentenddashloop;
                             // continue stateloop;
+                            case '<':
+                                appendStrBuf(c);
+                                state = transition(state, Tokenizer.COMMENT_LESSTHAN, reconsume, pos);
+                                continue stateloop;
                             case '\r':
                                 appendStrBufCarriageReturn();
                                 state = transition(state, Tokenizer.COMMENT, reconsume, pos);
@@ -2767,11 +2790,16 @@ private void ensureBufferSpace(int inputLength) throws SAXException {
                                  * Append a U+002D HYPHEN-MINUS (-) character to
                                  * the comment token's data.
                                  */
-                                adjustDoubleHyphenAndAppendToStrBufAndErr(c);
+                                adjustDoubleHyphenAndAppendToStrBufAndErr(c, reportedConsecutiveHyphens);
+                                reportedConsecutiveHyphens = true;
                                 /*
                                  * Stay in the comment end state.
                                  */
                                 continue;
+                            case '<':
+                                appendStrBuf(c);
+                                state = transition(state, Tokenizer.COMMENT_LESSTHAN, reconsume, pos);
+                                continue stateloop;
                             case '\r':
                                 adjustDoubleHyphenAndAppendToStrBufCarriageReturn();
                                 state = transition(state, Tokenizer.COMMENT, reconsume, pos);
@@ -2781,7 +2809,6 @@ private void ensureBufferSpace(int inputLength) throws SAXException {
                                 state = transition(state, Tokenizer.COMMENT, reconsume, pos);
                                 continue stateloop;
                             case '!':
-                                errHyphenHyphenBang();
                                 appendStrBuf(c);
                                 state = transition(state, Tokenizer.COMMENT_END_BANG, reconsume, pos);
                                 continue stateloop;
@@ -2794,7 +2821,8 @@ private void ensureBufferSpace(int inputLength) throws SAXException {
                                  * and the input character to the comment
                                  * token's data.
                                  */
-                                adjustDoubleHyphenAndAppendToStrBufAndErr(c);
+                                adjustDoubleHyphenAndAppendToStrBufAndErr(c, reportedConsecutiveHyphens);
+                                reportedConsecutiveHyphens = true;
                                 /*
                                  * Switch to the comment state.
                                  */
@@ -2864,6 +2892,148 @@ private void ensureBufferSpace(int inputLength) throws SAXException {
                                 continue stateloop;
                         }
                     }
+                case COMMENT_LESSTHAN:
+                    for (;;) {
+                        if (++pos == endPos) {
+                            break stateloop;
+                        }
+                        c = checkChar(buf, pos);
+                        switch (c) {
+                            case '!':
+                                appendStrBuf(c);
+                                state = transition(state, Tokenizer.COMMENT_LESSTHAN_BANG, reconsume, pos);
+                                continue stateloop;
+                            case '<':
+                                appendStrBuf(c);
+                                state = transition(state, Tokenizer.COMMENT_LESSTHAN, reconsume, pos);
+                                continue stateloop;
+                            case '-':
+                                appendStrBuf(c);
+                                state = transition(state, Tokenizer.COMMENT_END_DASH, reconsume, pos);
+                                continue stateloop;
+                            case '\r':
+                                appendStrBufCarriageReturn();
+                                break stateloop;
+                            case '\n':
+                                appendStrBufLineFeed();
+                                continue;
+                            case '\u0000':
+                                c = '\uFFFD';
+                                // fall thru
+                            default:
+                                appendStrBuf(c);
+                                state = transition(state, Tokenizer.COMMENT, reconsume, pos);
+                                continue stateloop;
+                        }
+                    }
+                case COMMENT_LESSTHAN_BANG:
+                    for (;;) {
+                        if (++pos == endPos) {
+                            break stateloop;
+                        }
+                        c = checkChar(buf, pos);
+                        switch (c) {
+                            case '-':
+                                appendStrBuf(c);
+                                state = transition(state, Tokenizer.COMMENT_LESSTHAN_BANG_DASH, reconsume, pos);
+                                continue stateloop;
+                            case '<':
+                                appendStrBuf(c);
+                                state = transition(state, Tokenizer.COMMENT_LESSTHAN, reconsume, pos);
+                                continue stateloop;
+                            case '\r':
+                                appendStrBufCarriageReturn();
+                                break stateloop;
+                            case '\n':
+                                appendStrBufLineFeed();
+                                continue;
+                            case '\u0000':
+                                c = '\uFFFD';
+                                // fall thru
+                            default:
+                                appendStrBuf(c);
+                                state = transition(state, Tokenizer.COMMENT, reconsume, pos);
+                                continue stateloop;
+                        }
+                    }
+                case COMMENT_LESSTHAN_BANG_DASH:
+                    for (;;) {
+                        if (++pos == endPos) {
+                            break stateloop;
+                        }
+                        c = checkChar(buf, pos);
+                        switch (c) {
+                            case '-':
+                                appendStrBuf(c);
+                                state = transition(state, Tokenizer.COMMENT_LESSTHAN_BANG_DASH_DASH, reconsume, pos);
+                                continue stateloop;
+                            case '<':
+                                appendStrBuf(c);
+                                state = transition(state, Tokenizer.COMMENT_LESSTHAN, reconsume, pos);
+                                continue stateloop;
+                            case '\r':
+                                appendStrBufCarriageReturn();
+                                break stateloop;
+                            case '\n':
+                                appendStrBufLineFeed();
+                                continue;
+                            case '\u0000':
+                                c = '\uFFFD';
+                                // fall thru
+                            default:
+                                appendStrBuf(c);
+                                state = transition(state, Tokenizer.COMMENT, reconsume, pos);
+                                continue stateloop;
+                        }
+                    }
+                case COMMENT_LESSTHAN_BANG_DASH_DASH:
+                    for (;;) {
+                        if (++pos == endPos) {
+                            break stateloop;
+                        }
+                        c = checkChar(buf, pos);
+                        switch (c) {
+                            case '>':
+                                appendStrBuf(c);
+                                emitComment(3, pos);
+                                state = transition(state, Tokenizer.DATA, reconsume, pos);
+                                continue stateloop;
+                            case '-':
+                                errNestedComment();
+                                adjustDoubleHyphenAndAppendToStrBufAndErr(c, reportedConsecutiveHyphens);
+                                reportedConsecutiveHyphens = true;
+                                state = transition(state, Tokenizer.COMMENT_END, reconsume, pos);
+                                continue stateloop;
+                            case '\r':
+                                errNestedComment();
+                                adjustDoubleHyphenAndAppendToStrBufAndErr(c, reportedConsecutiveHyphens);
+                                reportedConsecutiveHyphens = true;
+                                state = transition(state, Tokenizer.COMMENT, reconsume, pos);
+                                break stateloop;
+                            case '\n':
+                                errNestedComment();
+                                adjustDoubleHyphenAndAppendToStrBufAndErr(c, reportedConsecutiveHyphens);
+                                reportedConsecutiveHyphens = true;
+                                state = transition(state, Tokenizer.COMMENT, reconsume, pos);
+                                continue;
+                            case '\u0000':
+                                c = '\uFFFD';
+                                // fall thru
+                            case '!':
+                                errNestedComment();
+                                adjustDoubleHyphenAndAppendToStrBufAndErr(c, reportedConsecutiveHyphens);
+                                reportedConsecutiveHyphens = true;
+                                state = transition(state, Tokenizer.COMMENT_END_BANG, reconsume, pos);
+                                continue stateloop;
+                            default:
+                                errNestedComment();
+                                adjustDoubleHyphenAndAppendToStrBufAndErr(c, reportedConsecutiveHyphens);
+                                reportedConsecutiveHyphens = true;
+                                state = transition(state, Tokenizer.COMMENT_END, reconsume, pos);
+                                continue stateloop;
+                        }
+                    }
+                    // XXX reorder point
                 case COMMENT_START_DASH:
                     if (++pos == endPos) {
                         break stateloop;
@@ -2892,6 +3062,10 @@ private void ensureBufferSpace(int inputLength) throws SAXException {
                              */
                             state = transition(state, Tokenizer.DATA, reconsume, pos);
                             continue stateloop;
+                        case '<':
+                            appendStrBuf(c);
+                            state = transition(state, Tokenizer.COMMENT_LESSTHAN, reconsume, pos);
+                            continue stateloop;
                         case '\r':
                             appendStrBufCarriageReturn();
                             state = transition(state, Tokenizer.COMMENT, reconsume, pos);
@@ -6025,13 +6199,13 @@ private void initDoctypeFields() {
     @Inline private void adjustDoubleHyphenAndAppendToStrBufCarriageReturn()
             throws SAXException {
         silentCarriageReturn();
-        adjustDoubleHyphenAndAppendToStrBufAndErr('\n');
+        adjustDoubleHyphenAndAppendToStrBufAndErr('\n', false);
     }
 
     @Inline private void adjustDoubleHyphenAndAppendToStrBufLineFeed()
             throws SAXException {
         silentLineFeed();
-        adjustDoubleHyphenAndAppendToStrBufAndErr('\n');
+        adjustDoubleHyphenAndAppendToStrBufAndErr('\n', false);
     }
 
     @Inline private void appendStrBufLineFeed() {
@@ -6336,6 +6510,8 @@ public void eof() throws SAXException {
                     break eofloop;
                 case COMMENT_START:
                 case COMMENT:
+                case COMMENT_LESSTHAN:
+                case COMMENT_LESSTHAN_BANG:
                     /*
                      * EOF Parse error.
                      */
@@ -6347,6 +6523,7 @@ public void eof() throws SAXException {
                      */
                     break eofloop;
                 case COMMENT_END:
+                case COMMENT_LESSTHAN_BANG_DASH_DASH:
                     errEofInComment();
                     /* Emit the comment token. */
                     emitComment(2, 0);
@@ -6356,6 +6533,7 @@ public void eof() throws SAXException {
                     break eofloop;
                 case COMMENT_END_DASH:
                 case COMMENT_START_DASH:
+                case COMMENT_LESSTHAN_BANG_DASH:
                     errEofInComment();
                     /* Emit the comment token. */
                     emitComment(1, 0);
@@ -6980,7 +7158,7 @@ protected void errGtInPublicId() throws SAXException {
     protected void errNamelessDoctype() throws SAXException {
     }
 
-    protected void errConsecutiveHyphens() throws SAXException {
+    protected void errNestedComment() throws SAXException {
     }
 
     protected void errPrematureEndOfComment() throws SAXException {
@@ -7130,9 +7308,6 @@ protected void errExpectedSystemId() throws SAXException {
     protected void errMissingSpaceBeforeDoctypeName() throws SAXException {
     }
 
-    protected void errHyphenHyphenBang() throws SAXException {
-    }
-
     protected void errNcrControlChar() throws SAXException {
     }
 
diff --git a/parser/html/nsHtml5Tokenizer.cpp b/parser/html/nsHtml5Tokenizer.cpp
index 77498d7549419..566f6fd59fe48 100644
--- a/parser/html/nsHtml5Tokenizer.cpp
+++ b/parser/html/nsHtml5Tokenizer.cpp
@@ -455,6 +455,7 @@ template <class P>
 int32_t nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos,
                                     char16_t* buf, bool reconsume,
                                     int32_t returnState, int32_t endPos) {
+  bool reportedConsecutiveHyphens = false;
 stateloop:
   for (;;) {
     switch (state) {
@@ -1248,6 +1249,7 @@ int32_t nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos,
         [[fallthrough]];
       }
       case COMMENT_START: {
+        reportedConsecutiveHyphens = false;
         for (;;) {
           if (++pos == endPos) {
             NS_HTML5_BREAK(stateloop);
@@ -1270,6 +1272,13 @@ int32_t nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos,
                                     reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
+            case '<': {
+              appendStrBuf(c);
+              state = P::transition(mViewSource.get(),
+                                    nsHtml5Tokenizer::COMMENT_LESSTHAN,
+                                    reconsume, pos);
+              NS_HTML5_CONTINUE(stateloop);
+            }
             case '\r': {
               appendStrBufCarriageReturn();
               state = P::transition(mViewSource.get(),
@@ -1311,6 +1320,13 @@ int32_t nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos,
                                     reconsume, pos);
               NS_HTML5_BREAK(commentloop);
             }
+            case '<': {
+              appendStrBuf(c);
+              state = P::transition(mViewSource.get(),
+                                    nsHtml5Tokenizer::COMMENT_LESSTHAN,
+                                    reconsume, pos);
+              NS_HTML5_CONTINUE(stateloop);
+            }
             case '\r': {
               appendStrBufCarriageReturn();
               NS_HTML5_BREAK(stateloop);
@@ -1346,6 +1362,13 @@ int32_t nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos,
                                 nsHtml5Tokenizer::COMMENT_END, reconsume, pos);
               NS_HTML5_BREAK(commentenddashloop);
             }
+            case '<': {
+              appendStrBuf(c);
+              state = P::transition(mViewSource.get(),
+                                    nsHtml5Tokenizer::COMMENT_LESSTHAN,
+                                    reconsume, pos);
+              NS_HTML5_CONTINUE(stateloop);
+            }
             case '\r': {
               appendStrBufCarriageReturn();
               state = P::transition(mViewSource.get(),
@@ -1387,9 +1410,18 @@ int32_t nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos,
               NS_HTML5_CONTINUE(stateloop);
             }
             case '-': {
-              adjustDoubleHyphenAndAppendToStrBufAndErr(c);
+              adjustDoubleHyphenAndAppendToStrBufAndErr(
+                  c, reportedConsecutiveHyphens);
+              reportedConsecutiveHyphens = true;
               continue;
             }
+            case '<': {
+              appendStrBuf(c);
+              state = P::transition(mViewSource.get(),
+                                    nsHtml5Tokenizer::COMMENT_LESSTHAN,
+                                    reconsume, pos);
+              NS_HTML5_CONTINUE(stateloop);
+            }
             case '\r': {
               adjustDoubleHyphenAndAppendToStrBufCarriageReturn();
               state = P::transition(mViewSource.get(),
@@ -1403,9 +1435,6 @@ int32_t nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos,
               NS_HTML5_CONTINUE(stateloop);
             }
             case '!': {
-              if (P::reportErrors) {
-                errHyphenHyphenBang();
-              }
               appendStrBuf(c);
               state = P::transition(mViewSource.get(),
                                     nsHtml5Tokenizer::COMMENT_END_BANG,
@@ -1417,7 +1446,9 @@ int32_t nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos,
               [[fallthrough]];
             }
             default: {
-              adjustDoubleHyphenAndAppendToStrBufAndErr(c);
+              adjustDoubleHyphenAndAppendToStrBufAndErr(
+                  c, reportedConsecutiveHyphens);
+              reportedConsecutiveHyphens = true;
               state = P::transition(mViewSource.get(),
                                     nsHtml5Tokenizer::COMMENT, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
@@ -1470,6 +1501,215 @@ int32_t nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos,
           }
         }
       }
+      case COMMENT_LESSTHAN: {
+        for (;;) {
+          if (++pos == endPos) {
+            NS_HTML5_BREAK(stateloop);
+          }
+          c = checkChar(buf, pos);
+          switch (c) {
+            case '!': {
+              appendStrBuf(c);
+              state = P::transition(mViewSource.get(),
+                                    nsHtml5Tokenizer::COMMENT_LESSTHAN_BANG,
+                                    reconsume, pos);
+              NS_HTML5_CONTINUE(stateloop);
+            }
+            case '<': {
+              appendStrBuf(c);
+              state = P::transition(mViewSource.get(),
+                                    nsHtml5Tokenizer::COMMENT_LESSTHAN,
+                                    reconsume, pos);
+              NS_HTML5_CONTINUE(stateloop);
+            }
+            case '-': {
+              appendStrBuf(c);
+              state = P::transition(mViewSource.get(),
+                                    nsHtml5Tokenizer::COMMENT_END_DASH,
+                                    reconsume, pos);
+              NS_HTML5_CONTINUE(stateloop);
+            }
+            case '\r': {
+              appendStrBufCarriageReturn();
+              NS_HTML5_BREAK(stateloop);
+            }
+            case '\n': {
+              appendStrBufLineFeed();
+              continue;
+            }
+            case '\0': {
+              c = 0xfffd;
+            }
+            default: {
+              appendStrBuf(c);
+              state = P::transition(mViewSource.get(),
+                                    nsHtml5Tokenizer::COMMENT, reconsume, pos);
+              NS_HTML5_CONTINUE(stateloop);
+            }
+          }
+        }
+      }
+      case COMMENT_LESSTHAN_BANG: {
+        for (;;) {
+          if (++pos == endPos) {
+            NS_HTML5_BREAK(stateloop);
+          }
+          c = checkChar(buf, pos);
+          switch (c) {
+            case '-': {
+              appendStrBuf(c);
+              state = P::transition(
+                  mViewSource.get(),
+                  nsHtml5Tokenizer::COMMENT_LESSTHAN_BANG_DASH, reconsume, pos);
+              NS_HTML5_CONTINUE(stateloop);
+            }
+            case '<': {
+              appendStrBuf(c);
+              state = P::transition(mViewSource.get(),
+                                    nsHtml5Tokenizer::COMMENT_LESSTHAN,
+                                    reconsume, pos);
+              NS_HTML5_CONTINUE(stateloop);
+            }
+            case '\r': {
+              appendStrBufCarriageReturn();
+              NS_HTML5_BREAK(stateloop);
+            }
+            case '\n': {
+              appendStrBufLineFeed();
+              continue;
+            }
+            case '\0': {
+              c = 0xfffd;
+            }
+            default: {
+              appendStrBuf(c);
+              state = P::transition(mViewSource.get(),
+                                    nsHtml5Tokenizer::COMMENT, reconsume, pos);
+              NS_HTML5_CONTINUE(stateloop);
+            }
+          }
+        }
+      }
+      case COMMENT_LESSTHAN_BANG_DASH: {
+        for (;;) {
+          if (++pos == endPos) {
+            NS_HTML5_BREAK(stateloop);
+          }
+          c = checkChar(buf, pos);
+          switch (c) {
+            case '-': {
+              appendStrBuf(c);
+              state = P::transition(
+                  mViewSource.get(),
+                  nsHtml5Tokenizer::COMMENT_LESSTHAN_BANG_DASH_DASH, reconsume,
+                  pos);
+              NS_HTML5_CONTINUE(stateloop);
+            }
+            case '<': {
+              appendStrBuf(c);
+              state = P::transition(mViewSource.get(),
+                                    nsHtml5Tokenizer::COMMENT_LESSTHAN,
+                                    reconsume, pos);
+              NS_HTML5_CONTINUE(stateloop);
+            }
+            case '\r': {
+              appendStrBufCarriageReturn();
+              NS_HTML5_BREAK(stateloop);
+            }
+            case '\n': {
+              appendStrBufLineFeed();
+              continue;
+            }
+            case '\0': {
+              c = 0xfffd;
+            }
+            default: {
+              appendStrBuf(c);
+              state = P::transition(mViewSource.get(),
+                                    nsHtml5Tokenizer::COMMENT, reconsume, pos);
+              NS_HTML5_CONTINUE(stateloop);
+            }
+          }
+        }
+      }
+      case COMMENT_LESSTHAN_BANG_DASH_DASH: {
+        for (;;) {
+          if (++pos == endPos) {
+            NS_HTML5_BREAK(stateloop);
+          }
+          c = checkChar(buf, pos);
+          switch (c) {
+            case '>': {
+              appendStrBuf(c);
+              emitComment(3, pos);
+              state = P::transition(mViewSource.get(), nsHtml5Tokenizer::DATA,
+                                    reconsume, pos);
+              NS_HTML5_CONTINUE(stateloop);
+            }
+            case '-': {
+              if (P::reportErrors) {
+                errNestedComment();
+              }
+              adjustDoubleHyphenAndAppendToStrBufAndErr(
+                  c, reportedConsecutiveHyphens);
+              reportedConsecutiveHyphens = true;
+              state =
+                  P::transition(mViewSource.get(),
+                                nsHtml5Tokenizer::COMMENT_END, reconsume, pos);
+              NS_HTML5_CONTINUE(stateloop);
+            }
+            case '\r': {
+              if (P::reportErrors) {
+                errNestedComment();
+              }
+              adjustDoubleHyphenAndAppendToStrBufAndErr(
+                  c, reportedConsecutiveHyphens);
+              reportedConsecutiveHyphens = true;
+              state = P::transition(mViewSource.get(),
+                                    nsHtml5Tokenizer::COMMENT, reconsume, pos);
+              NS_HTML5_BREAK(stateloop);
+            }
+            case '\n': {
+              if (P::reportErrors) {
+                errNestedComment();
+              }
+              adjustDoubleHyphenAndAppendToStrBufAndErr(
+                  c, reportedConsecutiveHyphens);
+              reportedConsecutiveHyphens = true;
+              state = P::transition(mViewSource.get(),
+                                    nsHtml5Tokenizer::COMMENT, reconsume, pos);
+              continue;
+            }
+            case '\0': {
+              c = 0xfffd;
+            }
+            case '!': {
+              if (P::reportErrors) {
+                errNestedComment();
+              }
+              adjustDoubleHyphenAndAppendToStrBufAndErr(
+                  c, reportedConsecutiveHyphens);
+              reportedConsecutiveHyphens = true;
+              state = P::transition(mViewSource.get(),
+                                    nsHtml5Tokenizer::COMMENT_END_BANG,
+                                    reconsume, pos);
+              NS_HTML5_CONTINUE(stateloop);
+            }
+            default: {
+              if (P::reportErrors) {
+                errNestedComment();
+              }
+              adjustDoubleHyphenAndAppendToStrBufAndErr(
+                  c, reportedConsecutiveHyphens);
+              reportedConsecutiveHyphens = true;
+              state =
+                  P::transition(mViewSource.get(),
+                                nsHtml5Tokenizer::COMMENT_END, reconsume, pos);
+              NS_HTML5_CONTINUE(stateloop);
+            }
+          }
+        }
+      }
       case COMMENT_START_DASH: {
         if (++pos == endPos) {
           NS_HTML5_BREAK(stateloop);
@@ -1492,6 +1732,13 @@ int32_t nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos,
                                   reconsume, pos);
             NS_HTML5_CONTINUE(stateloop);
           }
+          case '<': {
+            appendStrBuf(c);
+            state = P::transition(mViewSource.get(),
+                                  nsHtml5Tokenizer::COMMENT_LESSTHAN, reconsume,
+                                  pos);
+            NS_HTML5_CONTINUE(stateloop);
+          }
           case '\r': {
             appendStrBufCarriageReturn();
             state = P::transition(mViewSource.get(), nsHtml5Tokenizer::COMMENT,
@@ -4286,18 +4533,22 @@ void nsHtml5Tokenizer::eof() {
         NS_HTML5_BREAK(eofloop);
       }
       case COMMENT_START:
-      case COMMENT: {
+      case COMMENT:
+      case COMMENT_LESSTHAN:
+      case COMMENT_LESSTHAN_BANG: {
         errEofInComment();
         emitComment(0, 0);
         NS_HTML5_BREAK(eofloop);
       }
-      case COMMENT_END: {
+      case COMMENT_END:
+      case COMMENT_LESSTHAN_BANG_DASH_DASH: {
         errEofInComment();
         emitComment(2, 0);
         NS_HTML5_BREAK(eofloop);
       }
       case COMMENT_END_DASH:
-      case COMMENT_START_DASH: {
+      case COMMENT_START_DASH:
+      case COMMENT_LESSTHAN_BANG_DASH: {
         errEofInComment();
         emitComment(1, 0);
         NS_HTML5_BREAK(eofloop);
diff --git a/parser/html/nsHtml5Tokenizer.h b/parser/html/nsHtml5Tokenizer.h
index d7ea9207ba44c..2dee8923cb289 100644
--- a/parser/html/nsHtml5Tokenizer.h
+++ b/parser/html/nsHtml5Tokenizer.h
@@ -214,6 +214,14 @@ class nsHtml5Tokenizer {
 
   static const int32_t AMBIGUOUS_AMPERSAND = 75;
 
+  static const int32_t COMMENT_LESSTHAN = 76;
+
+  static const int32_t COMMENT_LESSTHAN_BANG = 77;
+
+  static const int32_t COMMENT_LESSTHAN_BANG_DASH = 78;
+
+  static const int32_t COMMENT_LESSTHAN_BANG_DASH_DASH = 79;
+
  private:
   static const int32_t LEAD_OFFSET = (0xD800 - (0x10000 >> 10));
 
@@ -371,8 +379,8 @@ class nsHtml5Tokenizer {
   void emitStrBuf();
   inline void appendSecondHyphenToBogusComment() { appendStrBuf('-'); }
 
-  inline void adjustDoubleHyphenAndAppendToStrBufAndErr(char16_t c) {
-    errConsecutiveHyphens();
+  inline void adjustDoubleHyphenAndAppendToStrBufAndErr(
+      char16_t c, bool reportedConsecutiveHyphens) {
     appendStrBuf(c);
   }
 
@@ -405,12 +413,12 @@ class nsHtml5Tokenizer {
   void initDoctypeFields();
   inline void adjustDoubleHyphenAndAppendToStrBufCarriageReturn() {
     silentCarriageReturn();
-    adjustDoubleHyphenAndAppendToStrBufAndErr('\n');
+    adjustDoubleHyphenAndAppendToStrBufAndErr('\n', false);
   }
 
   inline void adjustDoubleHyphenAndAppendToStrBufLineFeed() {
     silentLineFeed();
-    adjustDoubleHyphenAndAppendToStrBufAndErr('\n');
+    adjustDoubleHyphenAndAppendToStrBufAndErr('\n', false);
   }
 
   inline void appendStrBufLineFeed() {
diff --git a/parser/html/nsHtml5TokenizerCppSupplement.h b/parser/html/nsHtml5TokenizerCppSupplement.h
index 19e54a50dd3f8..ca5b396e4480c 100644
--- a/parser/html/nsHtml5TokenizerCppSupplement.h
+++ b/parser/html/nsHtml5TokenizerCppSupplement.h
@@ -424,9 +424,9 @@ void nsHtml5Tokenizer::errMissingSpaceBeforeDoctypeName() {
   }
 }
 
-void nsHtml5Tokenizer::errHyphenHyphenBang() {
+void nsHtml5Tokenizer::errNestedComment() {
   if (MOZ_LIKELY(mViewSource)) {
-    mViewSource->AddErrorToCurrentNode("errHyphenHyphenBang");
+    mViewSource->AddErrorToCurrentNode("errNestedComment");
   }
 }
 
diff --git a/parser/html/nsHtml5TokenizerHSupplement.h b/parser/html/nsHtml5TokenizerHSupplement.h
index e1be9bdfbf93b..ba1e70f19e0c5 100644
--- a/parser/html/nsHtml5TokenizerHSupplement.h
+++ b/parser/html/nsHtml5TokenizerHSupplement.h
@@ -132,7 +132,7 @@ void errExpectedSystemId();
 
 void errMissingSpaceBeforeDoctypeName();
 
-void errHyphenHyphenBang();
+void errNestedComment();
 
 void errNcrControlChar();