Fix crash when encountered unmatched script end-tag token in TextMode

third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp

Index: third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp
diff --git a/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp b/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp
index eeb78031414d74fbce2f4d07947f5caf15b8edbf..fafd7bff256290841d64387cccb39b7808df593c 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp
+++ b/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp
@@ -2090,9 +2090,8 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken* token)
         processToken(token);
         break;
     case TextMode:
-        if (token->name() == scriptTag) {
+        if (token->name() == scriptTag && m_tree.currentStackItem()->hasTagName(scriptTag)) {
             // Pause ourselves so that parsing stops until the script can be processed by the caller.
-            ASSERT(m_tree.currentStackItem()->hasTagName(scriptTag));
             if (scriptingContentIsAllowed(m_tree.getParserContentPolicy()))
                 m_scriptToProcess = m_tree.currentElement();
             m_tree.openElements()->pop();