Track whether an element was inserted via document.write

third_party/WebKit/Source/core/html/parser/HTMLConstructionSite.cpp

Index: third_party/WebKit/Source/core/html/parser/HTMLConstructionSite.cpp
diff --git a/third_party/WebKit/Source/core/html/parser/HTMLConstructionSite.cpp b/third_party/WebKit/Source/core/html/parser/HTMLConstructionSite.cpp
index 2d9123887d8a670585479a129d2f14055cd6ceca..6813d68246d487453e5437400c15ef27ae78271a 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLConstructionSite.cpp
+++ b/third_party/WebKit/Source/core/html/parser/HTMLConstructionSite.cpp
@@ -652,9 +652,22 @@ void HTMLConstructionSite::insertScriptElement(AtomicHTMLToken* token)
     // For createContextualFragment, the specifications say to mark it parser-inserted and already-started and later unmark them.
     // However, we short circuit that logic to avoid the subtree traversal to find script elements since scripts can never see
     // those flags or effects thereof.
-    const bool parserInserted = m_parserContentPolicy != AllowScriptingContentAndDoNotMarkAlreadyStarted;
-    const bool alreadyStarted = m_isParsingFragment && parserInserted;
-    RawPtr<HTMLScriptElement> element = HTMLScriptElement::create(ownerDocumentForCurrentNode(), parserInserted, alreadyStarted);
+    int constructionFlags = DefaultContext;
+    if (m_parserContentPolicy != AllowScriptingContentAndDoNotMarkAlreadyStarted) {
+        constructionFlags |= ParserInserted;
+    }
+    if (m_isParsingFragment && (constructionFlags & ParserInserted)) {
+        constructionFlags |= AlreadyStarted;
+    }
+    // TODO(csharrison): This logic only works if the tokenizer/parser was not

[Bryan McQuade, 2016/04/04 21:43:57]

can we open a crbug for this and include a link to it in the comment? i'll do
the same in the comments in my patch.

+    // blocked waiting for scripts when the element was inserted. This usually
+    // fails for instance, on second document.write if a script writes twice in
+    // a row. To fix this, the parser might have to keep track of raw string
+    // position.
+    if (ownerDocumentForCurrentNode().isInDocumentWrite()) {
+        constructionFlags |= CreatedDuringDocumentWrite;
+    }
+    RawPtr<HTMLScriptElement> element = HTMLScriptElement::create(ownerDocumentForCurrentNode(), constructionFlags);
     setAttributes(element.get(), token, m_parserContentPolicy);
     if (scriptingContentIsAllowed(m_parserContentPolicy))
         attachLater(currentNode(), element);