Gracefully handle XMLDocumentParser being detached by mutation events.

Source/core/xml/parser/XMLDocumentParser.cpp

 /*
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
  * Copyright (C) 2005, 2006, 2008, 2014 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Holger Hans Peter Freyther
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 362 matching lines @@
 
 void XMLDocumentParser::handleError(XMLErrors::ErrorType type, const char* formattedMessage, TextPosition position)
 {
     m_xmlErrors.handleError(type, formattedMessage, position);
     if (type != XMLErrors::ErrorTypeWarning)
         m_sawError = true;
     if (type == XMLErrors::ErrorTypeFatal)
         stopParsing();
 }
 
-void XMLDocumentParser::enterText()
+void XMLDocumentParser::createLeafTextNodeIfNeeded()
 {
+    if (m_leafTextNode)
+        return;
+
     ASSERT(m_bufferedText.size() == 0);
-    ASSERT(!m_leafTextNode);
     m_leafTextNode = Text::create(m_currentNode->document(), "");
     m_currentNode->parserAppendChild(m_leafTextNode.get());
 }
 
-void XMLDocumentParser::exitText()
+bool XMLDocumentParser::updateLeafTextNode()
 {
     if (isStopped())
-        return;
+        return false;
 
     if (!m_leafTextNode)
-        return;
+        return true;
 
     m_leafTextNode->appendData(toString(m_bufferedText.data(), m_bufferedText.size()));
     m_bufferedText.clear();
     m_leafTextNode = nullptr;
+
+    // Mutation event handlers executed by appendData() might detach this parser.
+    return !isStopped();
 }
 
 void XMLDocumentParser::detach()
 {
     clearCurrentNodeStack();
     ScriptableDocumentParser::detach();
 }
 
 void XMLDocumentParser::end()
 {
     TRACE_EVENT0("blink", "XMLDocumentParser::end");
     // XMLDocumentParserLibxml2 will do bad things to the document if doEnd() is called.
     // I don't believe XMLDocumentParserQt needs doEnd called in the fragment case.
     ASSERT(!m_parsingFragment);
 
     doEnd();
 
     // doEnd() call above can detach the parser and null out its document.
     // In that case, we just bail out.
     if (isDetached())
         return;
 
     // doEnd() could process a script tag, thus pausing parsing.
     if (m_parserPaused)
         return;
 
     if (m_sawError) {
         insertErrorMessageBlock();
     } else {
-        exitText();
+        updateLeafTextNode();

[haraken, 2015/08/04 12:37:58]

Don't we need to early-return here?

[sof, 2015/08/04 12:42:35]

No, we could be in a Stopped state and need to bottom out instead. See ps#2
timeouts for what happens if you early-return.

[sof, 2015/08/04 13:52:31]

Added clarifying comment.

         document()->styleResolverChanged();
     }
 
     if (isParsing())
         prepareToStopParsing();
     document()->setReadyState(Document::Interactive);
     clearCurrentNodeStack();
     document()->finishedParsing();
 }
 
@@ skipping 543 matching lines @@
 {
     if (isStopped())
         return;
 
     if (m_parserPaused) {
         m_pendingCallbacks.append(adoptPtr(new PendingStartElementNSCallback(localName, prefix, uri, nbNamespaces, libxmlNamespaces,
             nbAttributes, nbDefaulted, libxmlAttributes)));
         return;
     }
 
-    exitText();
+    if (!updateLeafTextNode())
+        return;
 
     AtomicString adjustedURI = uri;
     if (m_parsingFragment && adjustedURI.isNull()) {
         if (!prefix.isNull())
             adjustedURI = m_prefixToNamespaceMap.get(prefix);
         else
             adjustedURI = m_defaultNamespaceURI;
     }
 
     bool isFirstElement = !m_sawFirstElement;
@@ skipping 56 matching lines @@
 
     if (m_parserPaused) {
         m_pendingCallbacks.append(adoptPtr(new PendingEndElementNSCallback()));
         return;
     }
 
     // JavaScript can detach the parser. Make sure this is not released before
     // the end of this method.
     RefPtrWillBeRawPtr<XMLDocumentParser> protect(this);
 
-    exitText();
+    if (!updateLeafTextNode())
+        return;
 
     RefPtrWillBeRawPtr<ContainerNode> n = m_currentNode;
     if (m_currentNode->isElementNode())
         toElement(n.get())->finishParsingChildren();
 
     if (!scriptingContentIsAllowed(parserContentPolicy()) && n->isElementNode() && toScriptLoaderIfPossible(toElement(n))) {
         popCurrentNode();
         n->remove(IGNORE_EXCEPTION);
         return;
     }
@@ skipping 55 matching lines @@
 void XMLDocumentParser::characters(const xmlChar* chars, int length)
 {
     if (isStopped())
         return;
 
     if (m_parserPaused) {
         m_pendingCallbacks.append(adoptPtr(new PendingCharactersCallback(chars, length)));
         return;
     }
 
-    if (!m_leafTextNode)
-        enterText();
+    createLeafTextNodeIfNeeded();
     m_bufferedText.append(chars, length);
 }
 
 void XMLDocumentParser::error(XMLErrors::ErrorType type, const char* message, va_list args)
 {
     if (isStopped())
         return;
 
     char formattedMessage[1024];
     vsnprintf(formattedMessage, sizeof(formattedMessage) - 1, message, args);
 
     if (m_parserPaused) {
         m_pendingCallbacks.append(adoptPtr(new PendingErrorCallback(type, reinterpret_cast<const xmlChar*>(formattedMessage), lineNumber(), columnNumber())));
         return;
     }
 
     handleError(type, formattedMessage, textPosition());
 }
 
 void XMLDocumentParser::processingInstruction(const String& target, const String& data)
 {
     if (isStopped())
         return;
 
     if (m_parserPaused) {
         m_pendingCallbacks.append(adoptPtr(new PendingProcessingInstructionCallback(target, data)));
         return;
     }
 
-    exitText();
+    if (!updateLeafTextNode())
+        return;
 
     // ### handle exceptions
     TrackExceptionState exceptionState;
     RefPtrWillBeRawPtr<ProcessingInstruction> pi = m_currentNode->document().createProcessingInstruction(target, data, exceptionState);
     if (exceptionState.hadException())
         return;
 
     pi->setCreatedByParser(true);
 
     m_currentNode->parserAppendChild(pi.get());
@@ skipping 21 matching lines @@
 void XMLDocumentParser::cdataBlock(const String& text)
 {
     if (isStopped())
         return;
 
     if (m_parserPaused) {
         m_pendingCallbacks.append(adoptPtr(new PendingCDATABlockCallback(text)));
         return;
     }
 
-    exitText();
+    if (!updateLeafTextNode())
+        return;
 
     m_currentNode->parserAppendChild(CDATASection::create(m_currentNode->document(), text));
 }
 
 void XMLDocumentParser::comment(const String& text)
 {
     if (isStopped())
         return;
 
     if (m_parserPaused) {
         m_pendingCallbacks.append(adoptPtr(new PendingCommentCallback(text)));
         return;
     }
 
-    exitText();
+    if (!updateLeafTextNode())
+        return;
 
     m_currentNode->parserAppendChild(Comment::create(m_currentNode->document(), text));
 }
 
 enum StandaloneInfo {
     StandaloneUnspecified = -2,
     NoXMlDeclaration,
     StandaloneNo,
     StandaloneYes
 };
@@ skipping 10 matching lines @@
         document()->setXMLVersion(version, ASSERT_NO_EXCEPTION);
     if (standalone != StandaloneUnspecified)
         document()->setXMLStandalone(standaloneInfo == StandaloneYes, ASSERT_NO_EXCEPTION);
     if (!encoding.isNull())
         document()->setXMLEncoding(encoding);
     document()->setHasXMLDeclaration(true);
 }
 
 void XMLDocumentParser::endDocument()
 {
-    exitText();
+    updateLeafTextNode();
 }
 
 void XMLDocumentParser::internalSubset(const String& name, const String& externalID, const String& systemID)
 {
     if (isStopped())
         return;
 
     if (m_parserPaused) {
         m_pendingCallbacks.append(adoptPtr(new PendingInternalSubsetCallback(name, externalID, systemID)));
         return;
@@ skipping 393 matching lines @@
     sax.initialized = XML_SAX2_MAGIC;
     RefPtr<XMLParserContext> parser = XMLParserContext::createStringParser(&sax, &state);
     String parseString = "<?xml version=\"1.0\"?><attrs " + string + " />";
     parseChunk(parser->context(), parseString);
     finishParsing(parser->context());
     attrsOK = state.gotAttributes;
     return state.attributes;
 }
 
 } // namespace blink