lowlevel/img.sky flaky crashes

sky/engine/core/html/parser/HTMLDocumentParser.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 365 matching lines @@
     return m_textPosition;
 }
 
 bool HTMLDocumentParser::isWaitingForScripts() const
 {
     return m_treeBuilder->hasParserBlockingScript() || m_scriptRunner.hasPendingScripts();
 }
 
 void HTMLDocumentParser::resumeAfterWaitingForImports()
 {
+    if (isStopped())
+        return;

[esprehn, 2015/01/14 19:00:47]

Why don't we always detach the parser when stopping it? The comment here:

https://github.com/domokit/mojo/blob/f990d6d37b72dfb491d7b9f266f258ec31b6027f...

seems like we should. Strangely it seems like we stop the parser before firing
unload events, and detach it later.

If we unified detach and stop we could make this ASSERT(isStopped());

[abarth-chromium, 2015/01/14 19:04:11]

Oops.  This branch shouldn't be here.  That was just something I did for
debugging.  I'll remove it.

     RefPtr<HTMLDocumentParser> protect(this);
     if (m_scriptRunner.hasPendingScripts())
         m_scriptRunner.executePendingScripts();
     ASSERT(!isExecutingScript());
     ASSERT(!isWaitingForScripts());
+    if (m_speculations.isEmpty())
+        return;
     ASSERT(m_haveBackgroundParser);
     pumpPendingSpeculations();
 }
 
 }