🤖 avm1: Report XML status -9 for unmatched start-tags

core/src/avm1/globals/xml.rs

@@ -50,7 +50,6 @@ pub enum XmlStatus {
     AttributeNotTerminated = -8,
 
     /// A start-tag was not matched with an end-tag.
-    #[expect(dead_code)]
     MismatchedStart = -9,
 
     /// An end-tag was encountered without a matching start-tag.
@@ -153,6 +152,20 @@ impl<'gc> Xml<'gc> {
                     | quick_xml::Error::InvalidAttr(AttrError::Duplicated(_, _)) => {
                         XmlStatus::ElementMalformed
                     }
+                    // Flash only treats the start-tag as unmatched when the end-tag
+                    // closes the element directly above it, as in `<a><b>foo</a>`.
+                    quick_xml::Error::IllFormed(IllFormedError::MismatchedEndTag {
+                        ref found,
+                        ..
+                    }) if open_tags
+                        .iter()
+                        .rev()
+                        .nth(1)
+                        .and_then(|node| node.node_name())
+                        .is_some_and(|name| name.to_utf8_lossy() == found.as_str()) =>
+                    {
+                        XmlStatus::MismatchedStart
+                    }
                     quick_xml::Error::IllFormed(
                         IllFormedError::MismatchedEndTag { .. }
                         | IllFormedError::UnmatchedEndTag { .. },
@@ -224,7 +237,12 @@ impl<'gc> Xml<'gc> {
                     let doctype = Some(AvmString::new(activation.gc(), doctype));
                     unlock!(Gc::write(activation.gc(), self.0), XmlData, doctype).set(doctype);
                 }
-                Event::Eof => break,
+                Event::Eof => {
+                    if open_tags.len() > 1 {
+                        self.0.status.set(XmlStatus::MismatchedStart);
+                    }
+                    break;
+                }
                 _ => {}
             }
         }

tests/tests/swfs/avm1/xml_status_mismatched_tags/output.txt

@@ -0,0 +1,63 @@
+case: <a><b>foo</a>
+  returned: -9
+  toString: <a><b>foo</b></a>
+case: <a><b>foo</a><c/>
+  returned: -9
+  toString: <a><b>foo</b></a>
+case: <a><b>foo</a>bar</a>
+  returned: -9
+  toString: <a><b>foo</b></a>
+case: <a><b>foo</a></b>
+  returned: -9
+  toString: <a><b>foo</b></a>
+case: <r><a><b>foo</a></r>
+  returned: -9
+  toString: <r><a><b>foo</b></a></r>
+case: <a><b><c>foo</b>
+  returned: -9
+  toString: <a><b><c>foo</c></b></a>
+case: <a><b><c>foo</a>
+  returned: -10
+  toString: <a><b><c>foo</c></b></a>
+case: <r><a><b><c>foo</a></r>
+  returned: -10
+  toString: <r><a><b><c>foo</c></b></a></r>
+case: <a><b>foo</b></c></a>
+  returned: -10
+  toString: <a><b>foo</b></a>
+case: <a>foo</b>
+  returned: -10
+  toString: <a>foo</a>
+case: <a><b/>foo</c>
+  returned: -10
+  toString: <a><b />foo</a>
+case: <a><b>foo</A>
+  returned: -10
+  toString: <a><b>foo</b></a>
+case: foo</a>
+  returned: -10
+  toString: foo
+case: <a></a></a>
+  returned: -10
+  toString: <a />
+case: <a>foo
+  returned: -9
+  toString: <a>foo</a>
+case: <a><b>foo</b>
+  returned: -9
+  toString: <a><b>foo</b></a>
+case: <a><b>
+  returned: -9
+  toString: <a><b /></a>
+case: <a/><b>
+  returned: -9
+  toString: <a /><b />
+case: <a><b>foo</b></a>
+  returned: 0
+  toString: <a><b>foo</b></a>
+case: <a>foo</a>
+  returned: 0
+  toString: <a>foo</a>
+case: <a/><b/>
+  returned: 0
+  toString: <a /><b />

tests/tests/swfs/avm1/xml_status_mismatched_tags/test.as

@@ -0,0 +1,34 @@
+var cases = [
+    // End-tag closes the element directly above the open one.
+    "<a><b>foo</a>",
+    "<a><b>foo</a><c/>",
+    "<a><b>foo</a>bar</a>",
+    "<a><b>foo</a></b>",
+    "<r><a><b>foo</a></r>",
+    "<a><b><c>foo</b>",
+    // End-tag closes an element further up, or one that isn't open.
+    "<a><b><c>foo</a>",
+    "<r><a><b><c>foo</a></r>",
+    "<a><b>foo</b></c></a>",
+    "<a>foo</b>",
+    "<a><b/>foo</c>",
+    "<a><b>foo</A>",
+    // End-tag with nothing open.
+    "foo</a>",
+    "<a></a></a>",
+    // Elements still open at the end of the input.
+    "<a>foo",
+    "<a><b>foo</b>",
+    "<a><b>",
+    "<a/><b>",
+    // Well-formed.
+    "<a><b>foo</b></a>",
+    "<a>foo</a>",
+    "<a/><b/>"
+];
+for (var i = 0; i < cases.length; i++) {
+    var xml = new XML(cases[i]);
+    trace("case: " + cases[i]);
+    trace("  returned: " + xml.status);
+    trace("  toString: " + xml.toString());
+}

tests/tests/swfs/avm1/xml_status_mismatched_tags/test.toml

@@ -0,0 +1,7 @@
+num_ticks = 1
+
+[[compilers]]
+type = "Rascal"
+target = "test.swf"
+scripts = ["test.as"]
+swf_version = 15