Clear pointers to PendingScript when dispose()d in pendingScriptFinished()

third_party/WebKit/Source/core/html/parser/HTMLParserScriptRunner.cpp

Index: third_party/WebKit/Source/core/html/parser/HTMLParserScriptRunner.cpp
diff --git a/third_party/WebKit/Source/core/html/parser/HTMLParserScriptRunner.cpp b/third_party/WebKit/Source/core/html/parser/HTMLParserScriptRunner.cpp
index 88afa39d916a2a36115136ef176f2b1000c90df6..7909e8d1155b93df5f0d9a466483ea6966b049af 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLParserScriptRunner.cpp
+++ b/third_party/WebKit/Source/core/html/parser/HTMLParserScriptRunner.cpp
@@ -363,6 +363,22 @@ void HTMLParserScriptRunner::pendingScriptFinished(
   // The parser is unprepared to be told, and doesn't need to be.
   if (isExecutingScript() && pendingScript->resource()->wasCanceled()) {
     pendingScript->dispose();
+
+    if (pendingScript == parserBlockingScript()) {
+      m_parserBlockingScript = nullptr;
+    } else {
+      CHECK_EQ(pendingScript, m_scriptsToExecuteAfterParsing.first());
+
+      // TODO(hiroshige): Remove this CHECK() before going to beta.
+      // This is only to make clusterfuzz to find a test case that executes
+      // this code path.
+      CHECK(false);
+
+      m_scriptsToExecuteAfterParsing.removeFirst();
+      // TODO(hiroshige): executeScriptsWaitingForParsing() should be
+      // called later at the appropriate time. https://crbug.com/696775
+    }
+
     return;
   }