XSS Auditor: Block by default.

third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 666 matching lines @@
     if (!m_tokenizer->nextToken(m_input.current(), token()))
       break;
 
     if (m_xssAuditor.isEnabled()) {
       m_sourceTracker.end(m_input.current(), m_tokenizer.get(), token());
 
       // We do not XSS filter innerHTML, which means we (intentionally) fail
       // http/tests/security/xssAuditor/dom-write-innerHTML.html
       if (std::unique_ptr<XSSInfo> xssInfo =
               m_xssAuditor.filterToken(FilterTokenRequest(
-                  token(), m_sourceTracker, m_tokenizer->shouldAllowCDATA())))
+                  token(), m_sourceTracker, m_tokenizer->shouldAllowCDATA()))) {
         m_xssAuditorDelegate.didBlockScript(*xssInfo);
+        // If we're in blocking mode, we might stop the parser in
+        // 'didBlockScript()'. In that case, exit early.
+        if (!isParsing())
+          return;
+      }
     }
 
     constructTreeFromHTMLToken();
     ASSERT(isStopped() || token().isUninitialized());
   }
 
   if (isStopped())
     return;
 
   // There should only be PendingText left since the tree-builder always flushes
@@ skipping 596 matching lines @@
     case Asynchronous:
       m_loadingTaskRunner->postTask(
           BLINK_FROM_HERE,
           WTF::bind(function, std::forward<Ps>(parameters)...));
       return;
   }
   NOTREACHED();
 }
 
 }  // namespace blink