Function decodeOneReference

lib/html/syntax.js:3626–3698

(match, nextCharCode, isAttribute)

 * @returns {string} decoded text, or `match` itself when it stays literal
 */
const decodeOneReference = (match, nextCharCode, isAttribute) => {
	// Numeric reference: A or A
	if (match.charCodeAt(1) === 0x23 /* # */) {
		const lastChar = match.charAt(match.length - 1);
		const isHex = match.charCodeAt(2) === 0x78 || match.charCodeAt(2) === 0x58;
		const body = isHex
			? lastChar === ";"
				? match.slice(3, -1)
				: match.slice(3)
			: lastChar === ";"
				? match.slice(2, -1)
				: match.slice(2);
		// The regex above guarantees at least one digit in `body`,
		// so `parseInt` always returns a finite number here.
		return decodeNumericReference(Number.parseInt(body, isHex ? 16 : 10));
	}

	// Named reference. Try the full captured name first, then
	// progressively shorter prefixes - this handles direct matches
	// like `&` as well as WHATWG longest-prefix semantics where
	// e.g. `&notpre;` decodes as `&not` (a legacy bare entity)
	// followed by `pre;` as literal text.
	const name = match.slice(1);
	const matchEndsWithSemi = name.charCodeAt(name.length - 1) === 0x3b;

	// Attribute-context guard: if the entity match didn't end with `;`
	// and the next character in the source is `=` or ASCII
	// alphanumeric, the WHATWG spec says to flush the literal text
	// rather than decode. The greedy regex already absorbed any
	// trailing alphanumerics, so the only candidate "next char" here
	// is `=` (or any non-alphanumeric).
	if (isAttribute && !matchEndsWithSemi && nextCharCode === 0x3d /* = */) {
		return match;
	}

	// Fast path: the regex usually captures exactly one entity (`&`,
	// `<`, ` `, …), so the whole `name` is the match — avoid the
	// full-length `name.slice(0, name.length)` the loop's first iteration
	// would allocate. No leftover, so the attribute guard never applies.
	if (name.length <= MAX_ENTITY_NAME_LEN) {
		const full = HTML_ENTITIES[name];
		if (full !== undefined) return full;
	}

	// Cap the longest-prefix search at MAX_ENTITY_NAME_LEN so pathological
	// inputs like `&` + thousands of alphanumerics stay linear-time.
	// Anything past that cap can't possibly match and is appended
	// verbatim as part of `name.slice(i)`. The full-length case was just
	// handled above, so start one shorter when it's the cap.
	const searchLen =
		name.length > MAX_ENTITY_NAME_LEN ? MAX_ENTITY_NAME_LEN : name.length - 1;
	for (let i = searchLen; i > 0; i--) {
		const prefix = name.slice(0, i);
		if (HTML_ENTITIES[prefix] !== undefined) {
			// Attribute-context longest-prefix guard: if the matched
			// prefix doesn't end with `;` and the leftover starts with
			// an alphanumeric character, leave literal per WHATWG.
			// (The regex greedy-consumes alphanumerics, so any leftover