Deal with frame removal by content scripts

third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  * Copyright (C) 2011, 2014 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 170 matching lines @@
     String takeLeadingWhitespace()
     {
         return takeLeading<isHTMLSpace<UChar>>();
     }
 
     void skipLeadingNonWhitespace()
     {
         skipLeading<isNotHTMLSpace<UChar>>();
     }
 
+    void skipRemaining()
+    {
+        m_current = m_end;
+    }
+
     String takeRemaining()
     {
         ASSERT(!isEmpty());
         unsigned start = m_current;
         m_current = m_end;
         // Notice that substring is smart enough to return *this when start == 0.
         return String(m_characters->substring(start, m_end - start));
     }
 
     void giveRemainingTo(StringBuilder& recipient)
@@ skipping 2080 matching lines @@
             return;
         defaultForInitial();
         // Fall through.
     }
     case BeforeHTMLMode: {
         ASSERT(insertionMode() == BeforeHTMLMode);
         buffer.skipLeadingWhitespace();
         if (buffer.isEmpty())
             return;
         defaultForBeforeHTML();
+        if (m_parser->isStopped()) {

[kouhei (in TOK), 2016/02/10 01:38:02]

I don't understand the intention of the change here. Would you describe this in
detail?

[robwu, 2016/02/10 10:19:52]

When the HTML document consists of text only, e.g. as in <iframe
srcdoc="text"></iframe>, then we fall through to to "case InHeadMode" below,
which calls m_tree.insertTextNode
(https://cs.chromium.org/HTMLConstructionSite%3A%3AinsertTextNode%20file%3Acpp),
which populates m_pendingText. The destructor of HTMLConstructionSite asserts
whether m_pendingText is empty
(https://cs.chromium.org/HTMLConstructionSite%3A%3A~HTMLConstructionSite%20fil...).
This assertion is triggered if we don't return early.

Now, before returning the buffer must also be drained, or an assertion would be
triggered in ~CharacterTokenBuffer:
https://cs.chromium.org/~CharacterTokenBuffer

I found these assertions when I ran the unit tests that I introduced with this
CL.

+            buffer.skipRemaining();
+            return;
+        }
         // Fall through.
     }
     case BeforeHeadMode: {
         ASSERT(insertionMode() == BeforeHeadMode);
         buffer.skipLeadingWhitespace();
         if (buffer.isEmpty())
             return;
         defaultForBeforeHead();
         // Fall through.
     }
@@ skipping 511 matching lines @@
     ASSERT(m_isAttached);
     // Warning, this may detach the parser. Do not do anything else after this.
     m_tree.finishedParsing();
 }
 
 void HTMLTreeBuilder::parseError(AtomicHTMLToken*)
 {
 }
 
 } // namespace blink