DocumentParser should flush itself on finish

Source/core/xml/parser/XMLDocumentParser.cpp

 /*
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
  * Copyright (C) 2005, 2006, 2008, 2014 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Holger Hans Peter Freyther
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 423 matching lines @@
     clearCurrentNodeStack();
     document()->finishedParsing();
 }
 
 void XMLDocumentParser::finish()
 {
     // FIXME: We should ASSERT(!m_parserStopped) here, since it does not
     // makes sense to call any methods on DocumentParser once it's been stopped.
     // However, FrameLoader::stop calls DocumentParser::finish unconditionally.
 
+    // flush may ending up executing arbitrary script, and possibly detach the parser.
+    RefPtr<XMLDocumentParser> protect(this);
+    flush();
+    if (isDetached())
+        return;
+
     if (m_parserPaused)
         m_finishCalled = true;
     else
         end();
 }
 
 void XMLDocumentParser::insertErrorMessageBlock()
 {
     m_xmlErrors.insertErrorMessageBlock();
 }
@@ skipping 1174 matching lines @@
     sax.initialized = XML_SAX2_MAGIC;
     RefPtr<XMLParserContext> parser = XMLParserContext::createStringParser(&sax, &state);
     String parseString = "<?xml version=\"1.0\"?><attrs " + string + " />";
     parseChunk(parser->context(), parseString);
     finishParsing(parser->context());
     attrsOK = state.gotAttributes;
     return state.attributes;
 }
 
 } // namespace blink