>if (needToDropLF) {
>    if (buf[start] == '\n') {
>        start++;
>        length--;
>        if (length == 0) {
>            return;
>        }
>    }
>    needToDropLF = false;
>}
If a bare LF is encountered (length == 1) then the needToDropLF flag is never reset. In this case multiple LF characters can get dropped. This is usually triggered because CR characters are is handled by emitting a bare LF and setting a flag to consume the next input character if it is an LF, but it also applies if the first LF of a PRE or TEXTAREA element is immediately followed by a CR, since that causes the buffer to be flushed.

I don't understand why emitXXX needs to flush the buffer and then handle a single character instead of appending the character to the buffer, but that's a side issue and not directly relevant to the bug.