Testing a fix to crbug.com/456059.

Source/core/html/HTMLScriptElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 55 matching lines @@
 }
 
 void HTMLScriptElement::childrenChanged(const ChildrenChange& change)
 {
     HTMLElement::childrenChanged(change);
     m_loader->childrenChanged();
 }
 
 void HTMLScriptElement::didMoveToNewDocument(Document& oldDocument)
 {
     RefPtrWillBeRawPtr<Document> contextDocument = document().contextDocument().get();

[sof, 2015/02/10 09:47:49]

Could you add 

  ScriptRunner::moveScriptToNewDocument(Document&, ScriptLoader*);

lifting out the resolving of both source & target (context) documents into
something shareable by HTMLScriptElement and SVGScriptElement?

     if (!contextDocument) {
         // Document's contextDocument() method will return no Document if the
         // following conditions both hold:
         //
         //   - The Document wasn't created with an explicit context document
         //     and that document is otherwise kept alive.
         //   - The Document itself is detached from its frame.
         //
         // The script element's loader is in that case moved to document() and
         // its script runner, which is the non-null Document that contextDocument()
         // would return if not detached.
         ASSERT(!document().frame());
         contextDocument = &document();
     }
-    oldDocument.scriptRunner()->movePendingAsyncScript(contextDocument->scriptRunner(), m_loader.get());
+    RefPtrWillBeRawPtr<Document> oldContextDocument = oldDocument.contextDocument().get();
+    if (!oldContextDocument)
+        oldContextDocument = &oldDocument;
+    if (oldContextDocument != contextDocument)
+        oldContextDocument->scriptRunner()->movePendingAsyncScript(contextDocument->scriptRunner(), m_loader.get());
     HTMLElement::didMoveToNewDocument(oldDocument);
 }
 
 void HTMLScriptElement::parseAttribute(const QualifiedName& name, const AtomicString& value)
 {
     if (name == srcAttr)
         m_loader->handleSourceAttribute(value);
     else if (name == asyncAttr)
         m_loader->handleAsyncAttribute();
     else
@@ skipping 124 matching lines @@
     return adoptRefWillBeNoop(new HTMLScriptElement(document(), false, m_loader->alreadyStarted()));
 }
 
 void HTMLScriptElement::trace(Visitor* visitor)
 {
     visitor->trace(m_loader);
     HTMLElement::trace(visitor);
 }
 
 }