Deal with frame removal by content scripts

third_party/WebKit/Source/core/xml/parser/XMLDocumentParser.cpp

 /*
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
  * Copyright (C) 2005, 2006, 2008, 2014 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Holger Hans Peter Freyther
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 1053 matching lines @@
     }
 
     if (isHTMLTemplateElement(*newElement))
         pushCurrentNode(toHTMLTemplateElement(*newElement).content());
     else
         pushCurrentNode(newElement.get());
 
     if (isHTMLHtmlElement(*newElement))
         toHTMLHtmlElement(*newElement).insertedByParser();
 
-    if (!m_parsingFragment && isFirstElement && document()->frame())
+    if (!m_parsingFragment && isFirstElement && document()->frame()) {
         document()->frame()->loader().dispatchDocumentElementAvailable();
+        document()->frame()->loader().runScriptsAtDocumentElementAvailable();
+        // runScriptsAtDocumentElementAvailable might have invalidated the document.
+    }
 }
 
 void XMLDocumentParser::endElementNs()
 {
     if (isStopped())
         return;
 
     if (m_parserPaused) {
         m_pendingCallbacks.append(adoptPtr(new PendingEndElementNSCallback(m_scriptStartPosition)));
         return;
@@ skipping 609 matching lines @@
     sax.initialized = XML_SAX2_MAGIC;
     RefPtr<XMLParserContext> parser = XMLParserContext::createStringParser(&sax, &state);
     String parseString = "<?xml version=\"1.0\"?><attrs " + string + " />";
     parseChunk(parser->context(), parseString);
     finishParsing(parser->context());
     attrsOK = state.gotAttributes;
     return state.attributes;
 }
 
 } // namespace blink