Fix crash when encountered unmatched script end-tag token in TextMode

third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  * Copyright (C) 2011, 2014 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 2072 matching lines @@
             return;
         }
         if (token->name() != brTag) {
             parseError(token);
             return;
         }
         defaultForInHeadNoscript();
         processToken(token);
         break;
     case TextMode:
-        if (token->name() == scriptTag) {
+        if (token->name() == scriptTag && m_tree.currentStackItem()->hasTagName(scriptTag)) {
             // Pause ourselves so that parsing stops until the script can be processed by the caller.
-            ASSERT(m_tree.currentStackItem()->hasTagName(scriptTag));
             if (scriptingContentIsAllowed(m_tree.getParserContentPolicy()))
                 m_scriptToProcess = m_tree.currentElement();
             m_tree.openElements()->pop();
             setInsertionMode(m_originalInsertionMode);
 
             if (m_parser->tokenizer()) {
                 // We must set the tokenizer's state to
                 // DataState explicitly if the tokenizer didn't have a chance to.
                 m_parser->tokenizer()->setState(HTMLTokenizer::DataState);
             }
@@ skipping 724 matching lines @@
         DEFINE_STRINGIFY(AfterFramesetMode)
         DEFINE_STRINGIFY(AfterAfterBodyMode)
         DEFINE_STRINGIFY(AfterAfterFramesetMode)
 #undef DEFINE_STRINGIFY
     }
     return "<unknown>";
 }
 #endif
 
 } // namespace blink