gh-160525: Keep expatbuilder text correct when handlers are overridden

A subclass of ExpatBuilder can replace the element, comment or
processing instruction handlers without calling the base
implementations, which are what end the pending run of character data.
Check that the Text node being extended is still the last child of the
current node before adding to it, and join any pending pieces when
parsing ends, so that such subclasses keep building the same tree.

Author: gpshead

Lib/test/test_minidom.py

@@ -1045,6 +1045,71 @@ def set_data(self, data):
             msg=f"Possible quadratic behavior: work={w1,w2,w3} ratios={r1,r2}"
         )
 
+    def testParseTextWithOverriddenHandlers(self):
+        # Character data must end up in the right place in the tree and
+        # be complete when a subclass of the builder replaces handlers
+        # without calling the base implementations.
+        class StartElement:
+            def start_element_handler(self, name, attributes):
+                node = self.document.createElement(name)
+                self.curNode.appendChild(node)
+                self.curNode = node
+
+        class EndElement:
+            def end_element_handler(self, name):
+                self.curNode = self.curNode.parentNode
+
+        class Comment:
+            def comment_handler(self, data):
+                self.curNode.appendChild(self.document.createComment(data))
+
+        class PI:
+            def pi_handler(self, target, data):
+                self.curNode.appendChild(
+                    self.document.createProcessingInstruction(target, data))
+
+        class RemovingEndElement:
+            def end_element_handler(self, name):
+                node = self.curNode
+                self.curNode = node.parentNode
+                if name == "d":
+                    self.curNode.removeChild(node)
+
+        source = ("<a>b<![CDATA[]]>c<d>e<![CDATA[]]>f</d>g<![CDATA[]]>h"
+                  "<!--i-->j<![CDATA[]]>k<?l m?>n<d/>o<![CDATA[]]>p</a>")
+        expected = source.replace("<![CDATA[]]>", "")
+        names = ["#text", "d", "#text", "#comment", "#text", "l", "#text",
+                 "d", "#text"]
+        ExpatBuilder = xml.dom.expatbuilder.ExpatBuilder
+        FragmentBuilder = xml.dom.expatbuilder.FragmentBuilder
+        for mixins in [(StartElement,), (EndElement,), (Comment,), (PI,),
+                       (StartElement, EndElement, Comment, PI)]:
+            with self.subTest(mixins=mixins):
+                class Builder(*mixins, ExpatBuilder):
+                    pass
+                dom = Builder().parseString(source)
+                root = dom.documentElement
+                self.assertEqual([c.nodeName for c in root.childNodes], names)
+                self.assertEqual(root.toxml(), expected)
+
+                class Builder(*mixins, FragmentBuilder):
+                    pass
+                fragment = Builder(dom).parseString("<d/>b<![CDATA[]]>c")
+                self.assertEqual(
+                    [(c.nodeName, getattr(c, 'data', None))
+                     for c in fragment.childNodes],
+                    [('d', None), ('#text', 'bc')])
+                dom.unlink()
+
+        class Builder(RemovingEndElement, ExpatBuilder):
+            pass
+        dom = Builder().parseString(source)
+        root = dom.documentElement
+        self.assertEqual([c.nodeName for c in root.childNodes],
+                         ["#text", "#comment", "#text", "l", "#text"])
+        self.assertEqual(root.toxml(), "<a>bcgh<!--i-->jk<?l m?>nop</a>")
+        dom.unlink()
+
     def testComment(self):
         dom = Document()
         comment = dom.createComment("comment")

Lib/xml/dom/expatbuilder.py

@@ -217,6 +217,7 @@ def parseFile(self, file):
             parser.Parse(b"", True)
         except ParseEscape:
             pass
+        self._flush_text()
         doc = self.document
         self.reset()
         self._parser = None
@@ -230,6 +231,7 @@ def parseString(self, string):
             self._setup_subset(string)
         except ParseEscape:
             pass
+        self._flush_text()
         doc = self.document
         self.reset()
         self._parser = None
@@ -275,7 +277,8 @@ def _flush_text(self):
         # Join the pieces of the current run of character data into
         # its Text node.  This must be called before anything else is
         # added to the tree after the Text node, and before the tree is
-        # handed to a filter.
+        # handed to a filter.  It is also called when parsing ends, as
+        # the handlers of a subclass might not have called it.
         node = self._text_node
         if node is not None:
             node.data = ''.join(self._text_parts)
@@ -307,10 +310,15 @@ def character_data_handler_cdata(self, data):
         _append_child(self.curNode, node)
 
     def character_data_handler(self, data):
-        if self._text_node is not None:
-            self._text_parts.append(data)
-            return
         childNodes = self.curNode.childNodes
+        if self._text_node is not None:
+            if childNodes and childNodes[-1] is self._text_node:
+                self._text_parts.append(data)
+                return
+            # The Text node is no longer the last child of the current
+            # node, which happens when a handler overridden in a
+            # subclass changes the tree without calling _flush_text().
+            self._flush_text()
         if childNodes and childNodes[-1].nodeType == TEXT_NODE:
             node = childNodes[-1]
             self._text_parts = [node.data, data]
@@ -667,6 +675,7 @@ def parseString(self, string):
         except:
             self.reset()
             raise
+        self._flush_text()
         fragment = self.fragment
         self.reset()
 ##         self._parser = None