When serializing an object to XML using newReader(), some of the entity replacements for '&' appear in the wrong places, giving invalid XML.
<a q='aaaaaaaaaaaaaaaaa'><t>Hall & Oates</t></a>
could be serialized as:
<a q='aaaaaaaa&aaaaaaaa'><t>Hall & Oates</t></a>
The bug depends on the sequence of the read()-calls, the size of the requested buffer, and the content. We're using the newReader to feed a Xalan transformation, and in some tens of millions different transformations, this has happened just a few times – but this time, we've isolated the problem, which is attached as a stand-alone test case.