Gracefully discharge a failed script load in disposed documents.

third_party/WebKit/Source/core/dom/ScriptRunner.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 25 matching lines @@
 #include "public/platform/WebThread.h"
 
 namespace blink {
 
 ScriptRunner::ScriptRunner(Document* document)
     : m_document(document)
     , m_taskRunner(Platform::current()->currentThread()->scheduler()->loadingTaskRunner())
     , m_numberOfInOrderScriptsWithPendingNotification(0)
     , m_isSuspended(false)
 #if !ENABLE(OILPAN)
+    , m_isDisposed(false)
     , m_weakPointerFactoryForTasks(this)
 #endif
 {
     ASSERT(document);
 #ifndef NDEBUG
     m_hasEverBeenSuspended = false;
 #endif
 }
 
 ScriptRunner::~ScriptRunner()
@@ skipping 35 matching lines @@
         scriptLoader->detach();
     for (ScriptLoader* scriptLoader : m_inOrderScriptsToExecuteSoon)
         scriptLoader->detach();
     for (ScriptLoader* scriptLoader : m_asyncScriptsToExecuteSoon)
         scriptLoader->detach();
 
     m_pendingInOrderScripts.clear();
     m_pendingAsyncScripts.clear();
     m_inOrderScriptsToExecuteSoon.clear();
     m_asyncScriptsToExecuteSoon.clear();
+    m_isDisposed = true;
 }
 #endif
 
 void ScriptRunner::addPendingAsyncScript(ScriptLoader* scriptLoader)
 {
     m_document->incrementLoadEventDelayCount();
     m_pendingAsyncScripts.add(scriptLoader);
 }
 
 void ScriptRunner::queueScriptForExecution(ScriptLoader* scriptLoader, ExecutionType executionType)
@@ skipping 75 matching lines @@
             postTask(BLINK_FROM_HERE);
         }
 
         break;
     }
 }
 
 void ScriptRunner::notifyScriptLoadError(ScriptLoader* scriptLoader, ExecutionType executionType)
 {
     switch (executionType) {
-    case ASYNC_EXECUTION:
+    case ASYNC_EXECUTION: {
+        bool foundLoader = m_pendingAsyncScripts.contains(scriptLoader);
+#if !ENABLE(OILPAN)
+        // If the document and ScriptRunner has been disposed of, there's
+        // no bookkeeping to be done here.
+        foundLoader = foundLoader || m_isDisposed;
+#endif
         // RELEASE_ASSERT makes us crash in a controlled way in error cases
         // where the ScriptLoader is associated with the wrong ScriptRunner
         // (otherwise we'd cause a use-after-free in ~ScriptRunner when it tries
         // to detach).
-        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(m_pendingAsyncScripts.contains(scriptLoader));
+        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(foundLoader);
         m_pendingAsyncScripts.remove(scriptLoader);
         break;
-
+    }
     case IN_ORDER_EXECUTION:
         RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(m_numberOfInOrderScriptsWithPendingNotification > 0);
         m_numberOfInOrderScriptsWithPendingNotification--;
 
         bool foundPendingScript = false;
         for (auto it = m_pendingInOrderScripts.begin(); it != m_pendingInOrderScripts.end(); ++it) {
             if (*it == scriptLoader) {
                 m_pendingInOrderScripts.remove(it);
                 foundPendingScript = true;
                 break;
             }
         }
+#if !ENABLE(OILPAN)
+        foundPendingScript = foundPendingScript || m_isDisposed;
+#endif
         RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(foundPendingScript);
         break;
     }
     scriptLoader->detach();
     m_document->decrementLoadEventDelayCount();
 }
 
 void ScriptRunner::movePendingAsyncScript(Document& oldDocument, Document& newDocument, ScriptLoader* scriptLoader)
 {
     RefPtrWillBeRawPtr<Document> newContextDocument = newDocument.contextDocument().get();
@@ skipping 62 matching lines @@
 #if ENABLE(OILPAN)
     visitor->trace(m_document);
     visitor->trace(m_pendingInOrderScripts);
     visitor->trace(m_pendingAsyncScripts);
     visitor->trace(m_asyncScriptsToExecuteSoon);
     visitor->trace(m_inOrderScriptsToExecuteSoon);
 #endif
 }
 
 } // namespace blink