diff --git a/.hgtags b/.hgtags
index 0c2443e..dfed3a9 100644
--- a/.hgtags
+++ b/.hgtags
@@ -1002,3 +1002,14 @@
 7dca173f654edf0720e62b72ef750c673bc6ebfe jdk8u212-b03
 90f8352e7f0642918735d66c38b3c6c44473691a jdk8u212-b04
 7dca173f654edf0720e62b72ef750c673bc6ebfe jdk8u212-ga
+c3b532bf906c9a55952a22dd39b42b711411cbc0 jdk8u222-b01
+e0ba0b931da8259728a6a14366734b3f1fcb40bc jdk8u222-b02
+33e1a4d78f739eab0cedb232cdc4b328d5867d00 jdk8u222-b03
+8ea2487d70605fcea46ab51b91911b46f8f5035b jdk8u222-b04
+de624afa6e750486bc1ea3e59bf9fb7de24b1379 jdk8u222-b05
+e18fe3687a512b39b08d7d8e288b06cfd7e18840 jdk8u222-b06
+08cd0a82185d3aaa614d628977e1809d6b4879cf jdk8u222-b07
+2b416473fe205b3abea19b8de53d948fbe4f67f1 jdk8u222-b08
+60d685ed9d5bb2eb4847d6e6e4237565fe40089b jdk8u222-b09
+268ffbdb01e136ccd78a5f3f8c8aa2d58e71fcb5 jdk8u222-b10
+268ffbdb01e136ccd78a5f3f8c8aa2d58e71fcb5 jdk8u222-ga
diff --git a/THIRD_PARTY_README b/THIRD_PARTY_README
index 2247356..814e5f2 100644
--- a/THIRD_PARTY_README
+++ b/THIRD_PARTY_README
@@ -1612,7 +1612,7 @@
 
 -------------------------------------------------------------------------------
 
-%% This notice is provided with respect to GIFLIB 5.1.1 & libungif 4.1.3, 
+%% This notice is provided with respect to GIFLIB 5.1.8 & libungif 4.1.3, 
 which may be included with JRE 8, JDK 8, and OpenJDK 8.
 
 --- begin of LICENSE ---
@@ -1682,7 +1682,7 @@
 --- begin of LICENSE ---
 
  Mesa 3-D graphics library
- Version:  4.1
+ Version:  5.0
 
  Copyright (C) 1999-2002  Brian Paul   All Rights Reserved.
 
@@ -2797,61 +2797,8 @@
 not be used in advertising or otherwise to promote the sale, use or
 other dealings in this Software without prior written authorization
 from the X Consortium.
-___________________________
-The files in motif/lib/Xm/util included this copyright:mkdirhier.man,
-xmkmf.man, chownxterm.c, makeg.man, mergelib.cpp, lndir.man, makestrs.man, 
-checktree.c, lndir.c, makestrs.c
-Copyright (c) 1993, 1994 X Consortium
 
-Permission is hereby granted, free of charge, to any person obtaining a
-copy of this software and associated documentation files (the "Software"),
-to deal in the Software without restriction, including without limitation
-the rights to use, copy, modify, merge, publish, distribute, sublicense,
-and/or sell copies of the Software, and to permit persons to whom the
-Software furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-THE X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
-WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF
-OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-Except as contained in this notice, the name of the X Consortium shall not
-be used in advertising or otherwise to promote the sale, use or other
-dealing in this Software without prior written authorization from the
-X Consortium.
-_____________________________
-Xmos_r.h:
-/*
-Copyright (c) 1996 X Consortium
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
-AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
-CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-Except as contained in this notice, the name of the X Consortium shall not be
-used in advertising or otherwise to promote the sale, use or other dealings
-in this Software without prior written authorization from the X Consortium.
-*/
-
+--- end of LICENSE ---
 _____________________________
 Copyright notice for HPkeysym.h:
 /*
@@ -2906,55 +2853,6 @@
 performance, or use of this material.
 
 */
-_____________________________________
-Copyright notice in keysym2ucs.h:
-
-Copyright 1987, 1994, 1998 The Open Group
-
-Permission to use, copy, modify, distribute, and sell this software and its
-documentation for any purpose is hereby granted without fee, provided that
-the above copyright notice appear in all copies and that both that
-copyright notice and this permission notice appear in supporting
-documentation.
-
-The above copyright notice and this permission notice shall be included
-in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR
-OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
-ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
-OTHER DEALINGS IN THE SOFTWARE.
-
-Except as contained in this notice, the name of The Open Group shall
-not be used in advertising or otherwise to promote the sale, use or
-other dealings in this Software without prior written authorization
-from The Open Group.
-
-
-Copyright 1987 by Digital Equipment Corporation, Maynard, Massachusetts
-
-All Rights Reserved
-
-Permission to use, copy, modify, and distribute this software and its
-documentation for any purpose and without fee is hereby granted,
-provided that the above copyright notice appear in all copies and that
-both that copyright notice and this permission notice appear in
-supporting documentation, and that the name of Digital not be
-used in advertising or publicity pertaining to distribution of the
-software without specific, written prior permission.
-
-DIGITAL DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
-ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
-DIGITAL BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
-ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
-WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
-ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
-SOFTWARE.
-
-*/
 
 --- end of LICENSE ---
 
@@ -3000,7 +2898,7 @@
   Apache Jakarta BCEL 5.1 
   Apache Jakarta Regexp 1.4 
   Apache Santuario XML Security for Java 1.5.4
-  Apache Xalan-Java 2.7.1 
+  Apache Xalan-Java 2.7.2
   Apache Xerces Java 2.10.0 
   Apache XML Resolver 1.1 
 
diff --git a/src/com/sun/org/apache/xalan/internal/Version.java b/src/com/sun/org/apache/xalan/internal/Version.java
index be9c19d..ff778c8 100644
--- a/src/com/sun/org/apache/xalan/internal/Version.java
+++ b/src/com/sun/org/apache/xalan/internal/Version.java
@@ -121,7 +121,7 @@
    */
   public static int getMaintenanceVersionNum()
   {
-    return 0;
+    return 2;
   }
 
   /**
diff --git a/src/com/sun/org/apache/xalan/internal/xsltc/compiler/FunctionAvailableCall.java b/src/com/sun/org/apache/xalan/internal/xsltc/compiler/FunctionAvailableCall.java
index 8cad427..6e91b75 100644
--- a/src/com/sun/org/apache/xalan/internal/xsltc/compiler/FunctionAvailableCall.java
+++ b/src/com/sun/org/apache/xalan/internal/xsltc/compiler/FunctionAvailableCall.java
@@ -100,20 +100,19 @@
      * the specified method is found in the specifed class.
      */
     private boolean hasMethods() {
-        LiteralExpr arg = (LiteralExpr)_arg;
 
         // Get the class name from the namespace uri
         String className = getClassNameFromUri(_namespaceOfFunct);
 
         // Get the method name from the argument to function-available
         String methodName = null;
-        int colonIndex = _nameOfFunct.indexOf(":");
+        int colonIndex = _nameOfFunct.indexOf(':');
         if (colonIndex > 0) {
           String functionName = _nameOfFunct.substring(colonIndex+1);
           int lastDotIndex = functionName.lastIndexOf('.');
           if (lastDotIndex > 0) {
             methodName = functionName.substring(lastDotIndex+1);
-            if (className != null && !className.equals(""))
+            if (className != null && className.length() != 0)
               className = className + "." + functionName.substring(0, lastDotIndex);
             else
               className = functionName.substring(0, lastDotIndex);
diff --git a/src/com/sun/org/apache/xalan/internal/xsltc/compiler/Sort.java b/src/com/sun/org/apache/xalan/internal/xsltc/compiler/Sort.java
index f7309e5..9b40267 100644
--- a/src/com/sun/org/apache/xalan/internal/xsltc/compiler/Sort.java
+++ b/src/com/sun/org/apache/xalan/internal/xsltc/compiler/Sort.java
@@ -65,7 +65,7 @@
     private AttributeValue _order;
     private AttributeValue _caseOrder;
     private AttributeValue _dataType;
-    private String         _lang; // bug! see 26869
+    private AttributeValue _lang; // bug! see 26869, see XALANJ-2546
 
     private String _className = null;
     private ArrayList<VariableRefBase> _closureVars = null;
@@ -153,13 +153,11 @@
         }
         _dataType = AttributeValue.create(this, val, parser);
 
-         _lang =  getAttribute("lang"); // bug! see 26869
-  // val =  getAttribute("lang");
-  // _lang = AttributeValue.create(this, val, parser);
+        val =  getAttribute("lang");
+        _lang = AttributeValue.create(this, val, parser);
         // Get the case order; default is language dependant
-    val = getAttribute("case-order");
-    _caseOrder = AttributeValue.create(this, val, parser);
-
+        val = getAttribute("case-order");
+        _caseOrder = AttributeValue.create(this, val, parser);
     }
 
     /**
@@ -178,6 +176,7 @@
         _order.typeCheck(stable);
         _caseOrder.typeCheck(stable);
         _dataType.typeCheck(stable);
+        _lang.typeCheck(stable);
         return Type.Void;
     }
 
@@ -195,16 +194,14 @@
         _order.translate(classGen, methodGen);
     }
 
-     public void translateCaseOrder(ClassGenerator classGen,
+    public void translateCaseOrder(ClassGenerator classGen,
                    MethodGenerator methodGen) {
-    _caseOrder.translate(classGen, methodGen);
+        _caseOrder.translate(classGen, methodGen);
     }
 
     public void translateLang(ClassGenerator classGen,
                    MethodGenerator methodGen) {
-    final ConstantPoolGen cpg = classGen.getConstantPool();
-    final InstructionList il = methodGen.getInstructionList();
-    il.append(new PUSH(cpg, _lang)); // bug! see 26869
+        _lang.translate(classGen, methodGen);
     }
 
     /**
diff --git a/src/com/sun/org/apache/xalan/internal/xsltc/dom/AdaptiveResultTreeImpl.java b/src/com/sun/org/apache/xalan/internal/xsltc/dom/AdaptiveResultTreeImpl.java
index cb50cf5..e92574c 100644
--- a/src/com/sun/org/apache/xalan/internal/xsltc/dom/AdaptiveResultTreeImpl.java
+++ b/src/com/sun/org/apache/xalan/internal/xsltc/dom/AdaptiveResultTreeImpl.java
@@ -570,7 +570,7 @@
         if (_openElementName != null) {
 
            int index;
-           if ((index =_openElementName.indexOf(":")) < 0)
+           if ((index =_openElementName.indexOf(':')) < 0)
                _dom.startElement(null, _openElementName, _openElementName, _attributes);
            else {
                 String uri =_dom.getNamespaceURI(_openElementName.substring(0,index));
@@ -682,7 +682,7 @@
     public void addAttribute(String qName, String value)
     {
         // "prefix:localpart" or "localpart"
-        int colonpos = qName.indexOf(":");
+        int colonpos = qName.indexOf(':');
         String uri = EMPTY_STRING;
         String localName = qName;
         if (colonpos >0)
diff --git a/src/com/sun/org/apache/xalan/internal/xsltc/runtime/BasisLibrary.java b/src/com/sun/org/apache/xalan/internal/xsltc/runtime/BasisLibrary.java
index 804b154..57feec3 100644
--- a/src/com/sun/org/apache/xalan/internal/xsltc/runtime/BasisLibrary.java
+++ b/src/com/sun/org/apache/xalan/internal/xsltc/runtime/BasisLibrary.java
@@ -1421,8 +1421,8 @@
      * This method should only be invoked if the name attribute is an AVT
      */
     public static void checkAttribQName(String name) {
-        final int firstOccur = name.indexOf(":");
-        final int lastOccur = name.lastIndexOf(":");
+        final int firstOccur = name.indexOf(':');
+        final int lastOccur = name.lastIndexOf(':');
         final String localName = name.substring(lastOccur + 1);
 
         if (firstOccur > 0) {
diff --git a/src/com/sun/org/apache/xml/internal/dtm/ref/DTMDefaultBase.java b/src/com/sun/org/apache/xml/internal/dtm/ref/DTMDefaultBase.java
index 58fae69..7ed1d8b 100644
--- a/src/com/sun/org/apache/xml/internal/dtm/ref/DTMDefaultBase.java
+++ b/src/com/sun/org/apache/xml/internal/dtm/ref/DTMDefaultBase.java
@@ -359,7 +359,7 @@
 
     while (low <= high)
     {
-      int mid = (low + high) / 2;
+      int mid = (low + high) >>> 1;
       int c = list[mid];
 
       if (c > value)
diff --git a/src/com/sun/org/apache/xml/internal/serializer/ToHTMLStream.java b/src/com/sun/org/apache/xml/internal/serializer/ToHTMLStream.java
index a68ec6d..633d0e9 100644
--- a/src/com/sun/org/apache/xml/internal/serializer/ToHTMLStream.java
+++ b/src/com/sun/org/apache/xml/internal/serializer/ToHTMLStream.java
@@ -1,6 +1,5 @@
 /*
- * reserved comment block
- * DO NOT REMOVE OR ALTER!
+ * Copyright (c) 2014, 2018, Oracle and/or its affiliates. All rights reserved.
  */
 /*
  * Copyright 2001-2004 The Apache Software Foundation.
@@ -43,6 +42,7 @@
  * because it is used from another package.
  *
  * @xsl.usage internal
+ * @LastModified: Sept 2018
  */
 public final class ToHTMLStream extends ToStream
 {
@@ -1021,7 +1021,7 @@
         String name,
         String value,
         ElemDesc elemDesc)
-        throws IOException
+        throws IOException, SAXException
     {
         writer.write(' ');
 
@@ -1345,7 +1345,7 @@
      */
     public void writeAttrString(
         final java.io.Writer writer, String string, String encoding)
-        throws IOException
+        throws IOException, SAXException
     {
         final int end = string.length();
         if (end > m_attrBuff.length)
@@ -1397,13 +1397,16 @@
                 }
                 else
                 {
-                    if (Encodings.isHighUTF16Surrogate(ch))
+                    if (Encodings.isHighUTF16Surrogate(ch) ||
+                            Encodings.isLowUTF16Surrogate(ch))
                     {
-
-                            writeUTF16Surrogate(ch, chars, i, end);
-                            i++; // two input characters processed
-                                 // this increments by one and the for()
-                                 // loop itself increments by another one.
+                        if (writeUTF16Surrogate(ch, chars, i, end) >= 0) {
+                            // move the index if the low surrogate is consumed
+                            // as writeUTF16Surrogate has written the pair
+                            if (Encodings.isHighUTF16Surrogate(ch)) {
+                                i++;
+                            }
+                        }
                     }
 
                     // The next is kind of a hack to keep from escaping in the case
diff --git a/src/com/sun/org/apache/xml/internal/serializer/ToStream.java b/src/com/sun/org/apache/xml/internal/serializer/ToStream.java
index 2301763..b4da7bb 100644
--- a/src/com/sun/org/apache/xml/internal/serializer/ToStream.java
+++ b/src/com/sun/org/apache/xml/internal/serializer/ToStream.java
@@ -1,6 +1,5 @@
 /*
- * reserved comment block
- * DO NOT REMOVE OR ALTER!
+ * Copyright (c) 2006, 2018, Oracle and/or its affiliates. All rights reserved.
  */
 /*
  * Copyright 2001-2004 The Apache Software Foundation.
@@ -51,6 +50,7 @@
  * serializers (xml, html, text ...) that write output to a stream.
  *
  * @xsl.usage internal
+ * @LastModified: Sept 2018
  */
 abstract public class ToStream extends SerializerBase
 {
@@ -200,6 +200,7 @@
      */
     private boolean m_expandDTDEntities = true;
 
+    private char m_highSurrogate = 0;
 
     /**
      * Default constructor
@@ -947,45 +948,46 @@
      * @param ch Character array.
      * @param i position Where the surrogate was detected.
      * @param end The end index of the significant characters.
-     * @return 0 if the pair of characters was written out as-is,
-     * the unicode code point of the character represented by
-     * the surrogate pair if an entity reference with that value
-     * was written out.
+     * @return the status of writing a surrogate pair.
+     *        -1 -- nothing is written
+     *         0 -- the pair is written as-is
+     *         code point -- the pair is written as an entity reference
      *
      * @throws IOException
      * @throws org.xml.sax.SAXException if invalid UTF-16 surrogate detected.
      */
     protected int writeUTF16Surrogate(char c, char ch[], int i, int end)
-        throws IOException
+        throws IOException, SAXException
     {
-        int codePoint = 0;
+        int status = -1;
         if (i + 1 >= end)
         {
-            throw new IOException(
-                Utils.messages.createMessage(
-                    MsgKey.ER_INVALID_UTF16_SURROGATE,
-                    new Object[] { Integer.toHexString((int) c)}));
+            m_highSurrogate = c;
+            return status;
         }
 
-        final char high = c;
-        final char low = ch[i+1];
+        char high, low;
+        if (m_highSurrogate == 0) {
+            high = c;
+            low = ch[i+1];
+            status = 0;
+        } else {
+            high = m_highSurrogate;
+            low = c;
+            m_highSurrogate = 0;
+        }
+
         if (!Encodings.isLowUTF16Surrogate(low)) {
-            throw new IOException(
-                Utils.messages.createMessage(
-                    MsgKey.ER_INVALID_UTF16_SURROGATE,
-                    new Object[] {
-                        Integer.toHexString((int) c)
-                            + " "
-                            + Integer.toHexString(low)}));
+            throwIOE(high, low);
         }
 
         final java.io.Writer writer = m_writer;
 
         // If we make it to here we have a valid high, low surrogate pair
-        if (m_encodingInfo.isInEncoding(c,low)) {
+        if (m_encodingInfo.isInEncoding(high,low)) {
             // If the character formed by the surrogate pair
             // is in the encoding, so just write it out
-            writer.write(ch,i,2);
+            writer.write(new char[]{high, low}, 0, 2);
         }
         else {
             // Don't know what to do with this char, it is
@@ -993,24 +995,16 @@
             // a surrogate pair, so write out as an entity ref
             final String encoding = getEncoding();
             if (encoding != null) {
-                /* The output encoding is known,
-                 * so somthing is wrong.
-                  */
-                codePoint = Encodings.toCodePoint(high, low);
-                // not in the encoding, so write out a character reference
-                writer.write('&');
-                writer.write('#');
-                writer.write(Integer.toString(codePoint));
-                writer.write(';');
+                status = writeCharRef(writer, high, low);
             } else {
                 /* The output encoding is not known,
                  * so just write it out as-is.
                  */
-                writer.write(ch, i, 2);
+                writer.write(new char[]{high, low}, 0, 2);
             }
         }
         // non-zero only if character reference was written out.
-        return codePoint;
+        return status;
     }
 
     /**
@@ -1100,32 +1094,7 @@
             }
             else if (isCData && (!escapingNotNeeded(c)))
             {
-                //                if (i != 0)
-                if (m_cdataTagOpen)
-                    closeCDATA();
-
-                // This needs to go into a function...
-                if (Encodings.isHighUTF16Surrogate(c))
-                {
-                    writeUTF16Surrogate(c, ch, i, end);
-                    i++ ; // process two input characters
-                }
-                else
-                {
-                    writer.write("&#");
-
-                    String intStr = Integer.toString((int) c);
-
-                    writer.write(intStr);
-                    writer.write(';');
-                }
-
-                //                if ((i != 0) && (i < (end - 1)))
-                //                if (!m_cdataTagOpen && (i < (end - 1)))
-                //                {
-                //                    writer.write(CDATA_DELIMITER_OPEN);
-                //                    m_cdataTagOpen = true;
-                //                }
+                i = handleEscaping(writer, c, ch, i, end);
             }
             else if (
                 isCData
@@ -1149,25 +1118,8 @@
                     }
                     writer.write(c);
                 }
-
-                // This needs to go into a function...
-                else if (Encodings.isHighUTF16Surrogate(c))
-                {
-                    if (m_cdataTagOpen)
-                        closeCDATA();
-                    writeUTF16Surrogate(c, ch, i, end);
-                    i++; // process two input characters
-                }
-                else
-                {
-                    if (m_cdataTagOpen)
-                        closeCDATA();
-                    writer.write("&#");
-
-                    String intStr = Integer.toString((int) c);
-
-                    writer.write(intStr);
-                    writer.write(';');
+                else {
+                    i = handleEscaping(writer, c, ch, i, end);
                 }
             }
         }
@@ -1175,6 +1127,38 @@
     }
 
     /**
+     * Handles escaping, writes either with a surrogate pair or a character
+     * reference.
+     *
+     * @param c the current char
+     * @param ch the character array
+     * @param i the current position
+     * @param end the end index of the array
+     * @return the next index
+     *
+     * @throws IOException
+     * @throws org.xml.sax.SAXException if invalid UTF-16 surrogate detected.
+     */
+    private int handleEscaping(Writer writer, char c, char ch[], int i, int end)
+            throws IOException, SAXException {
+        if (Encodings.isHighUTF16Surrogate(c) || Encodings.isLowUTF16Surrogate(c))
+        {
+            if (writeUTF16Surrogate(c, ch, i, end) >= 0) {
+                // move the index if the low surrogate is consumed
+                // as writeUTF16Surrogate has written the pair
+                if (Encodings.isHighUTF16Surrogate(c)) {
+                    i++ ;
+                }
+            }
+        }
+        else
+        {
+            writeCharRef(writer, c);
+        }
+        return i;
+    }
+
+    /**
      * Ends an un-escaping section.
      *
      * @see #startNonEscaping
@@ -1242,7 +1226,7 @@
             }
             m_ispreserve = true;
 
-            if (shouldIndent())
+            if (!m_cdataTagOpen && shouldIndent())
                 indent();
 
             boolean writeCDataBrackets =
@@ -1564,7 +1548,7 @@
         int i,
         char ch,
         int lastDirty,
-        boolean fromTextNode) throws IOException
+        boolean fromTextNode) throws IOException, SAXException
     {
         int startClean = lastDirty + 1;
         // if we have some clean characters accumulated
@@ -1643,54 +1627,41 @@
         int len,
         boolean fromTextNode,
         boolean escLF)
-        throws IOException
+        throws IOException, SAXException
     {
 
         int pos = accumDefaultEntity(writer, ch, i, chars, len, fromTextNode, escLF);
 
         if (i == pos)
         {
+            if (m_highSurrogate != 0) {
+                if (!(Encodings.isLowUTF16Surrogate(ch))) {
+                    throwIOE(m_highSurrogate, ch);
+                }
+                writeCharRef(writer, m_highSurrogate, ch);
+                m_highSurrogate = 0;
+                return ++pos;
+            }
+
             if (Encodings.isHighUTF16Surrogate(ch))
             {
-
-                // Should be the UTF-16 low surrogate of the hig/low pair.
-                char next;
-                // Unicode code point formed from the high/low pair.
-                int codePoint = 0;
-
                 if (i + 1 >= len)
                 {
-                    throw new IOException(
-                        Utils.messages.createMessage(
-                            MsgKey.ER_INVALID_UTF16_SURROGATE,
-                            new Object[] { Integer.toHexString(ch)}));
-                    //"Invalid UTF-16 surrogate detected: "
-
-                    //+Integer.toHexString(ch)+ " ?");
+                    // save for the next read
+                    m_highSurrogate = ch;
+                    pos++;
                 }
                 else
                 {
-                    next = chars[++i];
+                    // the next should be the UTF-16 low surrogate of the hig/low pair.
+                    char next = chars[++i];
 
                     if (!(Encodings.isLowUTF16Surrogate(next)))
-                        throw new IOException(
-                            Utils.messages.createMessage(
-                                MsgKey
-                                    .ER_INVALID_UTF16_SURROGATE,
-                                new Object[] {
-                                    Integer.toHexString(ch)
-                                        + " "
-                                        + Integer.toHexString(next)}));
-                    //"Invalid UTF-16 surrogate detected: "
+                        throwIOE(ch, next);
 
-                    //+Integer.toHexString(ch)+" "+Integer.toHexString(next));
-                    codePoint = Encodings.toCodePoint(ch,next);
+                    writeCharRef(writer, ch, next);
+                    pos += 2; // count the two characters that went into writing out this entity
                 }
-
-                writer.write("&#");
-                writer.write(Integer.toString(codePoint));
-                writer.write(';');
-                pos += 2; // count the two characters that went into writing out this entity
             }
             else
             {
@@ -1702,18 +1673,14 @@
                 if (isCharacterInC0orC1Range(ch) ||
                         (XMLVERSION11.equals(getVersion()) && isNELorLSEPCharacter(ch)))
                 {
-                    writer.write("&#");
-                    writer.write(Integer.toString(ch));
-                    writer.write(';');
+                    writeCharRef(writer, ch);
                 }
                 else if ((!escapingNotNeeded(ch) ||
                     (  (fromTextNode && m_charInfo.isSpecialTextChar(ch))
                      || (!fromTextNode && m_charInfo.isSpecialAttrChar(ch))))
-                && m_elemContext.m_currentElemDepth > 0)
+                     && m_elemContext.m_currentElemDepth > 0)
                 {
-                    writer.write("&#");
-                    writer.write(Integer.toString(ch));
-                    writer.write(';');
+                    writeCharRef(writer, ch);
                 }
                 else
                 {
@@ -1727,6 +1694,45 @@
     }
 
     /**
+     * Writes out a character reference.
+     * @param writer the writer
+     * @param c the character
+     * @throws IOException
+     */
+    private void writeCharRef(Writer writer, char c) throws IOException, SAXException {
+        if (m_cdataTagOpen)
+            closeCDATA();
+        writer.write("&#");
+        writer.write(Integer.toString(c));
+        writer.write(';');
+    }
+
+    /**
+     * Writes out a pair of surrogates as a character reference
+     * @param writer the writer
+     * @param high the high surrogate
+     * @param low the low surrogate
+     * @throws IOException
+     */
+    private int writeCharRef(Writer writer, char high, char low) throws IOException, SAXException {
+        if (m_cdataTagOpen)
+            closeCDATA();
+        // Unicode code point formed from the high/low pair.
+        int codePoint = Encodings.toCodePoint(high, low);
+        writer.write("&#");
+        writer.write(Integer.toString(codePoint));
+        writer.write(';');
+        return codePoint;
+    }
+
+    private void throwIOE(char ch, char next) throws IOException {
+        throw new IOException(Utils.messages.createMessage(
+                MsgKey.ER_INVALID_UTF16_SURROGATE,
+                new Object[] {Integer.toHexString(ch) + " "
+                        + Integer.toHexString(next)}));
+    }
+
+    /**
      * Receive notification of the beginning of an element, although this is a
      * SAX method additional namespace or attribute information can occur before
      * or after this call, that is associated with this element.
@@ -1962,7 +1968,7 @@
         Writer writer,
         String string,
         String encoding)
-        throws IOException
+        throws IOException, SAXException
     {
         final int len = string.length();
         if (len > m_attrBuff.length)
diff --git a/src/com/sun/org/apache/xml/internal/serializer/ToTextStream.java b/src/com/sun/org/apache/xml/internal/serializer/ToTextStream.java
index 9e39b89..aecf377 100644
--- a/src/com/sun/org/apache/xml/internal/serializer/ToTextStream.java
+++ b/src/com/sun/org/apache/xml/internal/serializer/ToTextStream.java
@@ -1,6 +1,5 @@
 /*
- * reserved comment block
- * DO NOT REMOVE OR ALTER!
+ * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
  */
 /*
  * Copyright 2001-2004 The Apache Software Foundation.
@@ -35,6 +34,7 @@
  * This class converts SAX or SAX-like calls to a
  * serialized document for xsl:output method of "text".
  * @xsl.usage internal
+ * @LastModified: Sept 2018
  */
 public final class ToTextStream extends ToStream
 {
@@ -296,23 +296,32 @@
             } else if (m_encodingInfo.isInEncoding(c)) {
                 writer.write(c);
                 // one input char processed
-            } else if (Encodings.isHighUTF16Surrogate(c)) {
+            } else if (Encodings.isHighUTF16Surrogate(c) ||
+                       Encodings.isLowUTF16Surrogate(c)) {
                 final int codePoint = writeUTF16Surrogate(c, ch, i, end);
-                if (codePoint != 0) {
-                    // I think we can just emit the message,
-                    // not crash and burn.
-                    final String integralValue = Integer.toString(codePoint);
-                    final String msg = Utils.messages.createMessage(
-                        MsgKey.ER_ILLEGAL_CHARACTER,
-                        new Object[] { integralValue, encoding });
+                if (codePoint >= 0) {
+                    // move the index if the low surrogate is consumed
+                    // as writeUTF16Surrogate has written the pair
+                    if (Encodings.isHighUTF16Surrogate(c)) {
+                        i++;
+                    }
 
-                    //Older behavior was to throw the message,
-                    //but newer gentler behavior is to write a message to System.err
-                    //throw new SAXException(msg);
-                    System.err.println(msg);
+                    // printing to the console is not appropriate, but will leave
+                    // it as is for compatibility.
+                    if (codePoint >0) {
+                        // I think we can just emit the message,
+                        // not crash and burn.
+                        final String integralValue = Integer.toString(codePoint);
+                        final String msg = Utils.messages.createMessage(
+                            MsgKey.ER_ILLEGAL_CHARACTER,
+                            new Object[] { integralValue, encoding });
 
+                        //Older behavior was to throw the message,
+                        //but newer gentler behavior is to write a message to System.err
+                        //throw new SAXException(msg);
+                        System.err.println(msg);
+                    }
                 }
-                i++; // two input chars processed
             } else {
                 // Don't know what to do with this char, it is
                 // not in the encoding and not a high char in
diff --git a/src/com/sun/org/apache/xml/internal/utils/NodeVector.java b/src/com/sun/org/apache/xml/internal/utils/NodeVector.java
index 8bba6d5..fd1171d 100644
--- a/src/com/sun/org/apache/xml/internal/utils/NodeVector.java
+++ b/src/com/sun/org/apache/xml/internal/utils/NodeVector.java
@@ -670,9 +670,9 @@
     /*
      *  Pick a pivot and move it out of the way
      */
-    int pivot = a[(lo + hi) / 2];
-
-    a[(lo + hi) / 2] = a[hi];
+    int mid = (lo + hi) >>> 1;
+    int pivot = a[mid];
+    a[mid] = a[hi];
     a[hi] = pivot;
 
     while (lo < hi)