Crash fix: Avoid using stale HTMLToken after tree construction

third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.h

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 189 matching lines @@
         Element* contextElement() const { ASSERT(m_fragment); return m_contextElementStackItem->element(); }
         HTMLStackItem* contextElementStackItem() const { ASSERT(m_fragment); return m_contextElementStackItem.get(); }
 
         DECLARE_TRACE();
 
     private:
         RawPtrWillBeMember<DocumentFragment> m_fragment;
         RefPtrWillBeMember<HTMLStackItem> m_contextElementStackItem;
     };
 
+    // https://html.spec.whatwg.org/#frameset-ok-flag
     bool m_framesetOk;
 #if ENABLE(ASSERT)
     bool m_isAttached;
 #endif
     FragmentParsingContext m_fragmentContext;
     HTMLConstructionSite m_tree;
 
     // http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#insertion-mode
     InsertionMode m_insertionMode;
 
@@ skipping 13 matching lines @@
 
     RefPtrWillBeMember<Element> m_scriptToProcess; // <script> tag which needs processing before resuming the parser.
     TextPosition m_scriptToProcessStartPosition; // Starting line number of the script tag needing processing.
 
     HTMLParserOptions m_options;
 };
 
 }
 
 #endif