--- a/dom/base/nsXMLContentSerializer.cpp
+++ b/dom/base/nsXMLContentSerializer.cpp
@@ -1204,33 +1204,36 @@ static const uint8_t kEntities[] = {
   _, _, _, _, _, _, _, _, 2, _,
   _, _, _, _, _, _, _, _, _, _,
   _, _, _, _, _, _, _, _, _, _,
   3, _, 4
 };
 
 // This table indexes into kEntityStrings[].
 static const uint8_t kAttrEntities[] = {
-  _, _, _, _, _, _, _, _, _, _,
-  _, _, _, _, _, _, _, _, _, _,
+  _, _, _, _, _, _, _, _, _, 5,
+  6, _, _, 7, _, _, _, _, _, _,
   _, _, _, _, _, _, _, _, _, _,
   _, _, _, _, 1, _, _, _, 2, _,
   _, _, _, _, _, _, _, _, _, _,
   _, _, _, _, _, _, _, _, _, _,
   3, _, 4
 };
 
 #undef _
 
 static const char* const kEntityStrings[] = {
   /* 0 */ nullptr,
   /* 1 */ """,
   /* 2 */ "&",
   /* 3 */ "<",
   /* 4 */ ">",
+  /* 5 */ "	",
+  /* 6 */ "
",
+  /* 7 */ "
",
 };
 
 bool
 nsXMLContentSerializer::AppendAndTranslateEntities(const nsAString& aStr,
                                                    nsAString& aOutputStr)
 {
   nsReadingIterator<char16_t> done_reading;
   aStr.EndReading(done_reading);

--- a/testing/web-platform/tests/domparsing/XMLSerializer-serializeToString.html
+++ b/testing/web-platform/tests/domparsing/XMLSerializer-serializeToString.html
@@ -34,11 +34,20 @@ test(function() {
 }, 'Check if the default namespace is correctly reset.');
 
 test(function() {
   var input = '<root xmlns="urn:bar"><outer xmlns=""><inner>value1</inner></outer></root>';
   var root = (new DOMParser()).parseFromString(input, 'text/xml').documentElement;
   var xmlString = (new XMLSerializer()).serializeToString(root);
   assert_equals(xmlString, '<root xmlns="urn:bar"><outer xmlns=""><inner>value1</inner></outer></root>');
 }, 'Check if there is no redundant empty namespace declaration.');
+
+test(function() {
+  var serializer = new XMLSerializer();
+  var root = createXmlDoc().documentElement;
+  root.firstChild.setAttribute('attr1', 'value1\tvalue2\r\n');
+  var xmlString = serializer.serializeToString(root);
+  assert_equals(xmlString, '<root><child1 attr1="value1&#9;value2&#xD;&#xA;">value1</child1></root>');
+}, 'check XMLSerializer.serializeToString escapes attribute values for roundtripping');
+
 </script>
  </body>
 </html>