replace invalid xml chars in element content in OptimizedForSpeedSaver

src/main/java/org/apache/xmlbeans/impl/store/Saver.java

@@ -2118,6 +2118,10 @@ private int entitizeAndWriteText(int bufLimit, int trailingBrackets) {
             int index = 0;
             for (int i = 0; i < bufLimit; i++) {
                 char c = _buf[i];
+                if (isBadChar(c)) {
+                    _buf[i] = '?';
+                    c = '?';
+                }
                 switch (c) {
                     case '<':
                         emit(_buf, index, i - index);

src/test/java/misc/checkin/SaveOptimizeForSpeedTest.java

@@ -98,6 +98,23 @@ void testCDataEndAcrossChunkBoundary() throws Exception {
         XmlObject.Factory.parse(out);
     }
 
+    @Test
+    void testBadCharInText() throws Exception {
+        // an invalid XML 1.0 character (a C0 control) in element content. The
+        // default saver replaces it with '?'; the speed path emitted it raw,
+        // producing output that is not well-formed.
+        XmlObject o = XmlObject.Factory.parse("<root/>");
+        try (XmlCursor cur = o.newCursor()) {
+            cur.toFirstChild();
+            cur.toFirstContentToken();
+            cur.insertChars("a\u0001b");
+        }
+        String out = saveForSpeed(o);
+        assertFalse(out.indexOf('\u0001') >= 0);
+        // before the fix the raw control char makes this a fatal parse error
+        XmlObject.Factory.parse(out);
+    }
+
     @Test
     void testProcInstTerminatorAcrossChunkBoundary() throws Exception {
         // a '?>' that straddles the 512-char chunk boundary: '?' is the last char