Updated InScope search basetypes to be namespace aware

Implements the todo added in b875b92

Case found by the fuzzer.

Author: jhy

src/main/java/org/jsoup/parser/HtmlTreeBuilder.java

@@ -28,10 +28,17 @@
  */
 public class HtmlTreeBuilder extends TreeBuilder {
     // tag searches. must be sorted, used in inSorted. HtmlTreeBuilderTest validates they're sorted.
-    // todo - tag search in scope might need to be properly namespace aware - https://html.spec.whatwg.org/#has-an-element-in-scope
-    static final String[] TagsSearchInScope = new String[]{
-        "annotation-xml", "applet", "caption", "desc", "foreignObject", "html", "marquee", "mi", "mn", "mo", "ms", "mtext", "object", "table", "td", "template", "th", "title" // <- svg title
+    static final String[] TagsSearchInScope = new String[]{ // a particular element in scope
+        "applet", "caption", "html", "marquee", "object", "table", "td", "template", "th"
     };
+    // math and svg namespaces for particular element in scope
+    static final String[]TagSearchInScopeMath = new String[] {
+        "annotation-xml",  "mi", "mn", "mo", "ms", "mtext"
+    };
+    static final String[]TagSearchInScopeSvg = new String[] {
+        "desc", "foreignObject", "title"
+    };
+
     static final String[] TagSearchList = new String[]{"ol", "ul"};
     static final String[] TagSearchButton = new String[]{"button"};
     static final String[] TagSearchTableScope = new String[]{"html", "table"};
@@ -681,13 +688,22 @@ private boolean inSpecificScope(String[] targetNames, String[] baseTypes, @Nulla
         // don't walk too far up the tree
         for (int pos = bottom; pos >= top; pos--) {
             Element el = stack.get(pos);
-            final String elName = el.normalName();
-            if (inSorted(elName, targetNames))
-                return true;
-            if (inSorted(elName, baseTypes))
-                return false;
-            if (extraTypes != null && inSorted(elName, extraTypes))
-                return false;
+            String elName = el.normalName();
+            // namespace checks - arguments provided are always in html ns, with this bolt-on for math and svg:
+            String ns = el.tag().namespace();
+            if (ns.equals(NamespaceHtml)) {
+                if (inSorted(elName, targetNames))
+                    return true;
+                if (inSorted(elName, baseTypes))
+                    return false;
+                if (extraTypes != null && inSorted(elName, extraTypes))
+                    return false;
+            } else if (baseTypes == TagsSearchInScope) {
+                if (ns.equals(NamespaceMathml) && inSorted(elName, TagSearchInScopeMath))
+                    return false;
+                if (ns.equals(NamespaceSvg) && inSorted(elName, TagSearchInScopeSvg))
+                    return false;
+            }
         }
         //Validate.fail("Should not be reachable"); // would end up false because hitting 'html' at root (basetypes)
         return false;

src/main/java/org/jsoup/parser/HtmlTreeBuilderState.java

@@ -1323,7 +1323,7 @@ private boolean anythingElse(Token t, HtmlTreeBuilder tb) {
                 Token.StartTag startTag = t.asStartTag();
                 String name = startTag.normalName();
 
-                if (inSorted(name, InCellNames)) { // th, th
+                if (inSorted(name, InCellNames)) { // td, th
                     tb.clearStackToTableRowContext();
                     tb.insertElementFor(startTag);
                     tb.transition(InCell);
@@ -1396,7 +1396,7 @@ private boolean anythingElse(Token t, HtmlTreeBuilder tb) {
                 Token.EndTag endTag = t.asEndTag();
                 String name = endTag.normalName();
 
-                if (inSorted(name, Constants.InCellNames)) {
+                if (inSorted(name, Constants.InCellNames)) { // td, th
                     if (!tb.inTableScope(name)) {
                         tb.error(this);
                         tb.transition(InRow); // might not be in scope if empty: <td /> and processing fake end tag

src/test/java/org/jsoup/parser/HtmlTreeBuilderTest.java

@@ -17,7 +17,7 @@ public class HtmlTreeBuilderTest {
     public void ensureSearchArraysAreSorted() {
         List<Object[]> constants = HtmlTreeBuilderStateTest.findConstantArrays(HtmlTreeBuilder.class);
         HtmlTreeBuilderStateTest.ensureSorted(constants);
-        assertEquals(11, constants.size());
+        assertEquals(13, constants.size());
     }
 
     @Test