Clear pointers to PendingScript when dispose()d in pendingScriptFinished()

third_party/WebKit/Source/core/html/parser/HTMLParserScriptRunner.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 345 matching lines @@
 void HTMLParserScriptRunner::pendingScriptFinished(
     PendingScript* pendingScript) {
   // Handle cancellations of parser-blocking script loads without
   // notifying the host (i.e., parser) if these were initiated by nested
   // document.write()s. The cancellation may have been triggered by
   // script execution to signal an abrupt stop (e.g., window.close().)
   //
   // The parser is unprepared to be told, and doesn't need to be.
   if (isExecutingScript() && pendingScript->resource()->wasCanceled()) {
     pendingScript->dispose();
+
+    if (pendingScript == parserBlockingScript()) {
+      m_parserBlockingScript = nullptr;
+    } else {
+      CHECK_EQ(pendingScript, m_scriptsToExecuteAfterParsing.first());
+
+      // TODO(hiroshige): Remove this CHECK() before going to beta.
+      // This is only to make clusterfuzz to find a test case that executes
+      // this code path.
+      CHECK(false);
+
+      m_scriptsToExecuteAfterParsing.removeFirst();
+      // TODO(hiroshige): executeScriptsWaitingForParsing() should be
+      // called later at the appropriate time. https://crbug.com/696775
+    }
+
     return;
   }
 
   // If the script was blocked as part of document.write intervention,
   // then send an asynchronous GET request with an interventions header.
   possiblyFetchBlockedDocWriteScript(pendingScript);
 
   m_host->notifyScriptLoaded(pendingScript);
 }
 
@@ skipping 300 matching lines @@
 
 DEFINE_TRACE(HTMLParserScriptRunner) {
   visitor->trace(m_document);
   visitor->trace(m_host);
   visitor->trace(m_parserBlockingScript);
   visitor->trace(m_scriptsToExecuteAfterParsing);
   PendingScriptClient::trace(visitor);
 }
 
 }  // namespace blink