Deal with frame removal by content scripts

third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp

Index: third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp
diff --git a/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp b/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp
index 3d1a4f5f267c891d67d04dd8747f2d978ad8519c..26bd6e752db6630fad2e76f52bce42cba9b11857 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp
+++ b/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp
@@ -188,6 +188,11 @@ public:
         skipLeading<isNotHTMLSpace<UChar>>();
     }
 
+    void skipRemaining()
+    {
+        m_current = m_end;
+    }
+
     String takeRemaining()
     {
         ASSERT(!isEmpty());
@@ -2288,6 +2293,10 @@ ReprocessBuffer:
         if (buffer.isEmpty())
             return;
         defaultForBeforeHTML();
+        if (m_parser->isStopped()) {

[kouhei (in TOK), 2016/02/10 01:38:02]

I don't understand the intention of the change here. Would you describe this in
detail?

[robwu, 2016/02/10 10:19:52]

When the HTML document consists of text only, e.g. as in <iframe
srcdoc="text"></iframe>, then we fall through to to "case InHeadMode" below,
which calls m_tree.insertTextNode
(https://cs.chromium.org/HTMLConstructionSite%3A%3AinsertTextNode%20file%3Acpp),
which populates m_pendingText. The destructor of HTMLConstructionSite asserts
whether m_pendingText is empty
(https://cs.chromium.org/HTMLConstructionSite%3A%3A~HTMLConstructionSite%20fil...).
This assertion is triggered if we don't return early.

Now, before returning the buffer must also be drained, or an assertion would be
triggered in ~CharacterTokenBuffer:
https://cs.chromium.org/~CharacterTokenBuffer

I found these assertions when I ran the unit tests that I introduced with this
CL.

+            buffer.skipRemaining();
+            return;
+        }
         // Fall through.
     }
     case BeforeHeadMode: {