Preload tokens even if a <meta> csp tag is found

third_party/WebKit/Source/core/html/parser/BackgroundHTMLParser.cpp

 /*
  * Copyright (C) 2013 Google, Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 234 matching lines @@
             TextPosition position = TextPosition(m_input.current().currentLine(), m_input.current().currentColumn());
 
             if (std::unique_ptr<XSSInfo> xssInfo = m_xssAuditor->filterToken(FilterTokenRequest(*m_token, m_sourceTracker, m_tokenizer->shouldAllowCDATA()))) {
                 xssInfo->m_textPosition = position;
                 m_pendingXSSInfos.append(std::move(xssInfo));
             }
 
             CompactHTMLToken token(m_token.get(), position);
 
             bool shouldEvaluateForDocumentWrite = false;
-            m_preloadScanner->scan(token, m_input.current(), m_pendingPreloads, &m_viewportDescription, &shouldEvaluateForDocumentWrite);
+            bool isCSPMetaTag = false;
+            m_preloadScanner->scan(token, m_input.current(), m_pendingPreloads, &m_viewportDescription, &isCSPMetaTag, &shouldEvaluateForDocumentWrite);
 
             simulatedToken = m_treeBuilderSimulator.simulate(token, m_tokenizer.get());
 
             // Break chunks before a script tag is inserted and flag the chunk as starting a script
             // so the main parser can decide if it should yield before processing the chunk.
             if (simulatedToken == HTMLTreeBuilderSimulator::ScriptStart) {
                 shouldNotifyMainThread |= queueChunkForMainThread();
                 m_startingScript = true;
             }
 
             m_pendingTokens->append(token);
+            if (isCSPMetaTag) {
+                m_pendingCSPMetaTokenIndex = m_pendingTokens->size() - 1;
+            }
             if (shouldEvaluateForDocumentWrite) {
                 m_likelyDocumentWriteScriptIndices.append(m_pendingTokens->size() - 1);
             }
         }
 
         m_token->clear();
 
         if (simulatedToken == HTMLTreeBuilderSimulator::ScriptEnd || m_pendingTokens->size() >= m_pendingTokenLimit) {
             shouldNotifyMainThread |= queueChunkForMainThread();
             // If we're far ahead of the main thread, yield for a bit to avoid consuming too much memory.
@@ skipping 40 matching lines @@
     if (m_viewportDescription.set)
         chunk->viewport = m_viewportDescription;
     chunk->xssInfos.swap(m_pendingXSSInfos);
     chunk->tokenizerState = m_tokenizer->getState();
     chunk->treeBuilderState = m_treeBuilderSimulator.state();
     chunk->inputCheckpoint = m_input.createCheckpoint(m_pendingTokens->size());
     chunk->preloadScannerCheckpoint = m_preloadScanner->createCheckpoint();
     chunk->tokens = std::move(m_pendingTokens);
     chunk->startingScript = m_startingScript;
     chunk->likelyDocumentWriteScriptIndices.swap(m_likelyDocumentWriteScriptIndices);
+    chunk->pendingCSPMetaTokenIndex.swap(m_pendingCSPMetaTokenIndex);

[kouhei (in TOK), 2016/08/22 05:34:03]

chunk->pendingCSPMetaTokenIndex = m_pendingCSPMetaTokenIndex;

[Charlie Harrison, 2016/08/22 14:08:05]

I used swap to also clear the m_pendingCSPMetaTokenIndex member. That ensures it
only tracks data for the current chunk. Updated this to reset the member to -1.

     m_startingScript = false;
 
     bool isEmpty = m_tokenizedChunkQueue->enqueue(std::move(chunk));
 
     DEFINE_STATIC_LOCAL(CustomCountHistogram, chunkEnqueueTime, ("Parser.ChunkEnqueueTime", 1, 10000, 50));
     chunkEnqueueTime.count(monotonicallyIncreasingTimeMS() - chunkStartTime);
 
 
     m_pendingTokens = wrapUnique(new CompactHTMLTokenStream);
     return isEmpty;
 }
 
 // If the background parser is already running on the main thread, then it is
 // not necessary to post a task to the main thread to run asynchronously. The
 // main parser deals with chunking up its own work.
 // TODO(csharrison): This is a pretty big hack because we don't actually need a
 // CrossThreadClosure in these cases. This is just experimental.
 template <typename FunctionType, typename... Ps>
 void BackgroundHTMLParser::runOnMainThread(FunctionType function, Ps&&... parameters)
 {
     if (isMainThread()) {
         (*WTF::bind(function, std::forward<Ps>(parameters)...))();
     } else {
         m_loadingTaskRunner->postTask(BLINK_FROM_HERE, crossThreadBind(function, std::forward<Ps>(parameters)...));
     }
 }
 
 } // namespace blink