Clear pointers to PendingScript when dispose()d in pendingScriptFinished()

third_party/WebKit/Source/core/html/parser/HTMLParserScriptRunner.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 345 matching lines @@
 void HTMLParserScriptRunner::pendingScriptFinished(
     PendingScript* pendingScript) {
   // Handle cancellations of parser-blocking script loads without
   // notifying the host (i.e., parser) if these were initiated by nested
   // document.write()s. The cancellation may have been triggered by
   // script execution to signal an abrupt stop (e.g., window.close().)
   //
   // The parser is unprepared to be told, and doesn't need to be.
   if (isExecutingScript() && pendingScript->resource()->wasCanceled()) {
     pendingScript->dispose();
+
+    // TODO(hiroshige): According to the comment above,
+    // this block is intended to process |m_parserBlockingScript|.
+    // If this CHECK() should fail, implement the case where
+    // |m_parserBlockingScript == m_scriptsToExecuteAfterParsing.first()|.

[kouhei (in TOK), 2017/02/28 00:41:48]

I'm not sure if we should do that per se. I'd rather rm member
m_parserBlockingScript and unify to one queue (possibly
m_scriptsToExecuteAfterParsing)

[hiroshige, 2017/02/28 00:48:55]

|m_parserBlockingScript| and |m_scriptsToExecuteAfterParsing| has separate
concepts in the spec, as commented in HTMLParserScriptRunner.h, so having these
two separately makes the code directly corresponds to the spec.

(It might be nice if we can unify these two also in the spec. I feel the
assumptions/invariants about these two are not so clear in impl or spec)

+    CHECK_EQ(pendingScript, parserBlockingScript());
+    m_parserBlockingScript = nullptr;
     return;
   }
 
   // If the script was blocked as part of document.write intervention,
   // then send an asynchronous GET request with an interventions header.
   possiblyFetchBlockedDocWriteScript(pendingScript);
 
   m_host->notifyScriptLoaded(pendingScript);
 }
 
@@ skipping 300 matching lines @@
 
 DEFINE_TRACE(HTMLParserScriptRunner) {
   visitor->trace(m_document);
   visitor->trace(m_host);
   visitor->trace(m_parserBlockingScript);
   visitor->trace(m_scriptsToExecuteAfterParsing);
   PendingScriptClient::trace(visitor);
 }
 
 }  // namespace blink