Crash fix: Avoid using stale HTMLToken after tree construction

third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  * Copyright (C) 2011, 2014 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 775 matching lines @@
         || token->name() == embedTag
         || token->name() == imgTag
         || token->name() == keygenTag
         || token->name() == wbrTag) {
         m_tree.reconstructTheActiveFormattingElements();
         m_tree.insertSelfClosingHTMLElement(token);
         m_framesetOk = false;
         return;
     }
     if (token->name() == inputTag) {
+        // Per spec https://html.spec.whatwg.org/#parsing-main-inbody,
+        // section "A start tag whose tag name is "input""
+
         Attribute* typeAttribute = token->getAttributeItem(typeAttr);
+        bool disableFrameset = !typeAttribute || !equalIgnoringCase(typeAttribute->value(), "hidden");
+
         m_tree.reconstructTheActiveFormattingElements();
+        // TODO(kouhei): Make it obvious that insertSelfClosingHTMLElement may mutate the token.
         m_tree.insertSelfClosingHTMLElement(token);
-        if (!typeAttribute || !equalIgnoringCase(typeAttribute->value(), "hidden"))
+
+        if (disableFrameset)
             m_framesetOk = false;
         return;
     }
     if ((RuntimeEnabledFeatures::contextMenuEnabled() && token->name() == menuitemTag)
         || token->name() == paramTag
         || token->name() == sourceTag
         || token->name() == trackTag) {
         m_tree.insertSelfClosingHTMLElement(token);
         return;
     }
@@ skipping 1994 matching lines @@
     ASSERT(m_isAttached);
     // Warning, this may detach the parser. Do not do anything else after this.
     m_tree.finishedParsing();
 }
 
 void HTMLTreeBuilder::parseError(AtomicHTMLToken*)
 {
 }
 
 } // namespace blink