From 898b8ffcb69208ef5d4c70270fdf1d78bf669a2d Mon Sep 17 00:00:00 2001
From: ovf <unknown>
Date: Wed, 28 Jul 2021 00:37:26 +0100
Subject: [PATCH] LibWeb: Avoid assertion failure on parsing numeric character
 references

---
 Tests/LibWeb/TestHTMLTokenizer.cpp                     |  2 +-
 .../Libraries/LibWeb/HTML/Parser/HTMLTokenizer.cpp     | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/Tests/LibWeb/TestHTMLTokenizer.cpp b/Tests/LibWeb/TestHTMLTokenizer.cpp
index 7c844696187..689ca5f2b80 100644
--- a/Tests/LibWeb/TestHTMLTokenizer.cpp
+++ b/Tests/LibWeb/TestHTMLTokenizer.cpp
@@ -166,7 +166,7 @@ TEST_CASE(multiple_attributes)
 
 TEST_CASE(character_reference_in_attribute)
 {
-    auto tokens = run_tokenizer("<p foo=a&amp;b bar='a&amp;b' baz=\"a&amp;b\">");
+    auto tokens = run_tokenizer("<p foo=a&amp;b bar='a&#38;b' baz=\"a&#x26;b\">");
     BEGIN_ENUMERATION(tokens);
     EXPECT_START_TAG_TOKEN(p);
     EXPECT_TAG_TOKEN_ATTRIBUTE_COUNT(3);
diff --git a/Userland/Libraries/LibWeb/HTML/Parser/HTMLTokenizer.cpp b/Userland/Libraries/LibWeb/HTML/Parser/HTMLTokenizer.cpp
index 5fc69491e04..7e57c30c0a5 100644
--- a/Userland/Libraries/LibWeb/HTML/Parser/HTMLTokenizer.cpp
+++ b/Userland/Libraries/LibWeb/HTML/Parser/HTMLTokenizer.cpp
@@ -1554,7 +1554,7 @@ _StartOfFunction:
                 ON('#')
                 {
                     m_temporary_buffer.append(current_input_character.value());
-                    SWITCH_TO(NumericCharacterReference);
+                    SWITCH_TO_WITH_UNCLEAN_BUILDER(NumericCharacterReference);
                 }
                 ANYTHING_ELSE
                 {
@@ -1630,12 +1630,12 @@ _StartOfFunction:
                 ON('X')
                 {
                     m_temporary_buffer.append(current_input_character.value());
-                    SWITCH_TO(HexadecimalCharacterReferenceStart);
+                    SWITCH_TO_WITH_UNCLEAN_BUILDER(HexadecimalCharacterReferenceStart);
                 }
                 ON('x')
                 {
                     m_temporary_buffer.append(current_input_character.value());
-                    SWITCH_TO(HexadecimalCharacterReferenceStart);
+                    SWITCH_TO_WITH_UNCLEAN_BUILDER(HexadecimalCharacterReferenceStart);
                 }
                 ANYTHING_ELSE
                 {
@@ -1696,7 +1696,7 @@ _StartOfFunction:
                 }
                 ON(';')
                 {
-                    SWITCH_TO(NumericCharacterReferenceEnd);
+                    SWITCH_TO_WITH_UNCLEAN_BUILDER(NumericCharacterReferenceEnd);
                 }
                 ANYTHING_ELSE
                 {
@@ -1716,7 +1716,7 @@ _StartOfFunction:
                 }
                 ON(';')
                 {
-                    SWITCH_TO(NumericCharacterReferenceEnd);
+                    SWITCH_TO_WITH_UNCLEAN_BUILDER(NumericCharacterReferenceEnd);
                 }
                 ANYTHING_ELSE
                 {