Fix frameset within fragment asserts in HTMLTreeBuilder

third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  * Copyright (C) 2011, 2014 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 601 matching lines @@
         parseError(token);
         if (!m_tree.openElements()->secondElementIsHTMLBodyElement() || m_tree.openElements()->hasOnlyOneElement()) {
             ASSERT(isParsingFragmentOrTemplateContents());
             return;
         }
         if (!m_framesetOk)
             return;
         m_tree.openElements()->bodyElement()->remove(ASSERT_NO_EXCEPTION);
         m_tree.openElements()->popUntil(m_tree.openElements()->bodyElement());
         m_tree.openElements()->popHTMLBodyElement();
-        ASSERT(m_tree.openElements()->top() == m_tree.openElements()->htmlElement());
+
+        // Note: in the fragment case the root is a DocumentFragment instead of
+        // a proper html element which is a quirk in Blink's implementation.
+        DCHECK(!isParsingTemplateContents());
+        DCHECK(!isParsingFragment() || toDocumentFragment(m_tree.openElements()->topNode()));
+        DCHECK(isParsingFragment() || m_tree.openElements()->top() == m_tree.openElements()->htmlElement());
         m_tree.insertHTMLElement(token);
         setInsertionMode(InFramesetMode);
         return;
     }
     if (token->name() == addressTag
         || token->name() == articleTag
         || token->name() == asideTag
         || token->name() == blockquoteTag
         || token->name() == centerTag
         || token->name() == detailsTag
@@ skipping 2196 matching lines @@
         DEFINE_STRINGIFY(AfterFramesetMode)
         DEFINE_STRINGIFY(AfterAfterBodyMode)
         DEFINE_STRINGIFY(AfterAfterFramesetMode)
 #undef DEFINE_STRINGIFY
     }
     return "<unknown>";
 }
 #endif
 
 } // namespace blink