Let notifyScriptLoadError() handle already detached ScriptLoaders.

third_party/WebKit/Source/core/dom/ScriptRunner.cpp

Index: third_party/WebKit/Source/core/dom/ScriptRunner.cpp
diff --git a/third_party/WebKit/Source/core/dom/ScriptRunner.cpp b/third_party/WebKit/Source/core/dom/ScriptRunner.cpp
index 9dddabdc5796785e9f83b3120304a81cc51e71e9..7eaf99e3e25a3b31f5b86aa265e8d34e213784a0 100644
--- a/third_party/WebKit/Source/core/dom/ScriptRunner.cpp
+++ b/third_party/WebKit/Source/core/dom/ScriptRunner.cpp
@@ -204,12 +204,22 @@ void ScriptRunner::notifyScriptLoadError(ScriptLoader* scriptLoader, ExecutionTy
         // where the ScriptLoader is associated with the wrong ScriptRunner
         // (otherwise we'd cause a use-after-free in ~ScriptRunner when it tries
         // to detach).
-        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(m_pendingAsyncScripts.contains(scriptLoader));
+        bool foundLoader = m_pendingAsyncScripts.contains(scriptLoader);
+#if !ENABLE(OILPAN)
+        // If the ScriptRunner has been disposed of, no pending scripts remain.
+        // Verify that the ScriptLoader is in a detached state, if so.
+        foundLoader = foundLoader || (scriptLoader->isDetached() && m_pendingAsyncScripts.isEmpty());
+#endif
+        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(foundLoader);
         m_pendingAsyncScripts.remove(scriptLoader);
         break;
     }
     case IN_ORDER_EXECUTION:
-        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(removePendingInOrderScript(scriptLoader));
+        bool foundLoader = removePendingInOrderScript(scriptLoader);
+#if !ENABLE(OILPAN)
+        foundLoader = foundLoader || (scriptLoader->isDetached() && m_pendingInOrderScripts.isEmpty());
+#endif
+        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(foundLoader);
         break;
     }
     scriptLoader->detach();