Code: HTMLTreeBuilderSimulator::SimulatedToken HTMLTreeBuilderSimulator::Simulate(
    const CompactHTMLToken& token,
    HTMLTokenizer* tokenizer) {
  SimulatedToken simulated_token = kOtherToken;

  if (token.GetType() == HTMLToken::kStartTag) {
    const String& tag_name = token.Data();
    if (ThreadSafeMatch(tag_name, SVGNames::svgTag))
      namespace_stack_.push_back(SVG);
    if (ThreadSafeMatch(tag_name, MathMLNames::mathTag))
       namespace_stack_.push_back(kMathML);
     if (InForeignContent() && TokenExitsForeignContent(token))
       namespace_stack_.pop_back();
    if ((namespace_stack_.back() == SVG && TokenExitsSVG(token)) ||
        (namespace_stack_.back() == kMathML && TokenExitsMath(token)))
       namespace_stack_.push_back(HTML);
    if (!InForeignContent()) {
       if (ThreadSafeMatch(tag_name, textareaTag) ||
          ThreadSafeMatch(tag_name, titleTag)) {
        tokenizer->SetState(HTMLTokenizer::kRCDATAState);
      } else if (ThreadSafeMatch(tag_name, scriptTag)) {
        tokenizer->SetState(HTMLTokenizer::kScriptDataState);
        simulated_token = kScriptStart;
      } else if (ThreadSafeMatch(tag_name, linkTag)) {
        simulated_token = kLink;
      } else if (!in_select_insertion_mode_) {
        if (ThreadSafeMatch(tag_name, plaintextTag) &&
            !in_select_insertion_mode_) {
          tokenizer->SetState(HTMLTokenizer::kPLAINTEXTState);
        } else if (ThreadSafeMatch(tag_name, styleTag) ||
                   ThreadSafeMatch(tag_name, iframeTag) ||
                   ThreadSafeMatch(tag_name, xmpTag) ||
                   (ThreadSafeMatch(tag_name, noembedTag) &&
                    options_.plugins_enabled) ||
                   ThreadSafeMatch(tag_name, noframesTag) ||
                   (ThreadSafeMatch(tag_name, noscriptTag) &&
                    options_.script_enabled)) {
          tokenizer->SetState(HTMLTokenizer::kRAWTEXTState);
        }
      }

      if (ThreadSafeMatch(tag_name, selectTag)) {
        in_select_insertion_mode_ = true;
      } else if (in_select_insertion_mode_ && TokenExitsInSelect(token)) {
        in_select_insertion_mode_ = false;
      }
    }
  }

  if (token.GetType() == HTMLToken::kEndTag ||
      (token.GetType() == HTMLToken::kStartTag && token.SelfClosing() &&
       InForeignContent())) {
    const String& tag_name = token.Data();
    if ((namespace_stack_.back() == SVG &&
          ThreadSafeMatch(tag_name, SVGNames::svgTag)) ||
         (namespace_stack_.back() == kMathML &&
          ThreadSafeMatch(tag_name, MathMLNames::mathTag)) ||
        (namespace_stack_.Contains(SVG) && namespace_stack_.back() == HTML &&
         TokenExitsSVG(token)) ||
         (namespace_stack_.Contains(kMathML) &&
          namespace_stack_.back() == HTML && TokenExitsMath(token))) {
       namespace_stack_.pop_back();
    }
    if (ThreadSafeMatch(tag_name, scriptTag)) {
      if (!InForeignContent())
        tokenizer->SetState(HTMLTokenizer::kDataState);
      return kScriptEnd;
    } else if (ThreadSafeMatch(tag_name, selectTag)) {
      in_select_insertion_mode_ = false;
    }
    if (ThreadSafeMatch(tag_name, styleTag))
      simulated_token = kStyleEnd;
  }

  tokenizer->SetForceNullCharacterReplacement(InForeignContent());
  tokenizer->SetShouldAllowCDATA(InForeignContent());
   return simulated_token;
 }

Vulnerability Type: XSS Bypass 
CWE ID: CWE-79
Summary: Insufficient data validation in HTML parser in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
Commit Message: HTML parser: Fix "HTML integration point" implementation in HTMLTreeBuilderSimulator.

HTMLTreeBuilderSimulator assumed only <foreignObject> as an HTML
integration point. This CL adds <annotation-xml>, <desc>, and SVG
<title>.

Bug: 805924
Change-Id: I6793d9163d4c6bc8bf0790415baedddaac7a1fc2
Reviewed-on: https://chromium-review.googlesource.com/964038
Commit-Queue: Kent Tamura <tkent@chromium.org>
Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Cr-Commit-Position: refs/heads/master@{#543634}