XMLSerializer: Fix conflict between a generated ns* prefix and existing xmlns:ns*.

This CL restores the loop removed in crrev.com/629490.
The new behavior matches to Firefox though it doesn't conform to the
specification.

Add a test case to WPT based on the current specification, and
Blink has a failing expectation.

Bug: 928639
Change-Id: Ica431543440b538400cf1af086cab27cf59c4dc8
Reviewed-on: https://chromium-review.googlesource.com/c/1454023
Auto-Submit: Kent Tamura <tkent@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#629842}

third_party/blink/renderer/core/editing/serializers/markup_accumulator.cc

@@ -269,11 +269,14 @@ AtomicString MarkupAccumulator::LookupNamespaceURI(const AtomicString& prefix) {
 // https://w3c.github.io/DOM-Parsing/#dfn-generating-a-prefix
 AtomicString MarkupAccumulator::GeneratePrefix(
     const AtomicString& new_namespace) {
-  // 1. Let generated prefix be the concatenation of the string "ns" and the
-  // current numerical value of prefix index.
-  AtomicString generated_prefix = "ns" + String::Number(prefix_index_);
-  // 2. Let the value of prefix index be incremented by one.
-  ++prefix_index_;
+  AtomicString generated_prefix;
+  do {
+    // 1. Let generated prefix be the concatenation of the string "ns" and the
+    // current numerical value of prefix index.
+    generated_prefix = "ns" + String::Number(prefix_index_);
+    // 2. Let the value of prefix index be incremented by one.
+    ++prefix_index_;
+  } while (LookupNamespaceURI(generated_prefix));
   // 3. Add to map the generated prefix given the new namespace namespace.
   AddPrefix(generated_prefix, new_namespace);
   // 4. Return the value of generated prefix.

third_party/blink/web_tests/external/wpt/domparsing/XMLSerializer-serializeToString-expected.txt

+This is a testharness.js-based test.
+PASS check XMLSerializer.serializeToString method could parsing xmldoc to string
+PASS Check if the default namespace is correctly reset.
+PASS Check if there is no redundant empty namespace declaration.
+PASS check XMLSerializer.serializeToString escapes attribute values for roundtripping
+PASS Check if generated prefixes match to "ns${index}".
+FAIL Check if "ns1" is generated even if the element already has xmlns:ns1. assert_equals: expected "<root xmlns:ns2=\"uri2\"><child xmlns:ns1=\"uri1\" xmlns:ns1=\"uri3\" ns1:attr1=\"value1\"/></root>" but got "<root xmlns:ns2=\"uri2\"><child xmlns:ns1=\"uri1\" xmlns:ns3=\"uri3\" ns3:attr1=\"value1\"/></root>"
+Harness: the test ran to completion.
+

third_party/blink/web_tests/external/wpt/domparsing/XMLSerializer-serializeToString.html

@@ -65,6 +65,16 @@ test(function() {
   assert_equals(xmlString, '<root><child1 xmlns:ns1="uri1" ns1:attr1="value1" xmlns:ns2="uri2" ns2:attr2="value2"/><child2 xmlns:ns3="uri3" ns3:attr3="value3"/></root>');
 }, 'Check if generated prefixes match to "ns${index}".');
 
+test(function() {
+  const input = '<root xmlns:ns2="uri2"><child xmlns:ns1="uri1"/></root>';
+  const root = (new DOMParser()).parseFromString(input, 'text/xml').documentElement;
+  root.firstChild.setAttributeNS('uri3', 'attr1', 'value1');
+  const xmlString = (new XMLSerializer()).serializeToString(root);
+  // According to 'DOM Parsing and Serialization' draft as of 2018-12-11,
+  // 'generate a prefix' result can conflict with an existing xmlns:ns* declaration.
+  assert_equals(xmlString, '<root xmlns:ns2="uri2"><child xmlns:ns1="uri1" xmlns:ns1="uri3" ns1:attr1="value1"/></root>');
+}, 'Check if "ns1" is generated even if the element already has xmlns:ns1.');
+
 </script>
  </body>
 </html>