ScriptRunner: ASSERT -> RELEASE_ASSERT.

Source/core/dom/ScriptRunner.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 72 matching lines @@
 void ScriptRunner::resume()
 {
     if (hasPendingScripts())
         m_timer.startOneShot(0, FROM_HERE);
 }
 
 void ScriptRunner::notifyScriptReady(ScriptLoader* scriptLoader, ExecutionType executionType)
 {
     switch (executionType) {
     case ASYNC_EXECUTION:
-        ASSERT(m_pendingAsyncScripts.contains(scriptLoader));
+        // RELEASE_ASSERT makes us crash in a controlled way in error cases
+        // where the ScriptLoader is associated with the wrong ScriptRunner
+        // (otherwise we'd cause a use-after-free in ~ScriptRunner when it tries
+        // to detach).
+        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(m_pendingAsyncScripts.contains(scriptLoader));
         m_scriptsToExecuteSoon.append(scriptLoader);
         m_pendingAsyncScripts.remove(scriptLoader);
         break;
 
     case IN_ORDER_EXECUTION:
-        ASSERT(!m_scriptsToExecuteInOrder.isEmpty());
+        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(!m_scriptsToExecuteInOrder.isEmpty());
         break;
     }
     m_timer.startOneShot(0, FROM_HERE);
 }
 
 void ScriptRunner::notifyScriptLoadError(ScriptLoader* scriptLoader, ExecutionType executionType)
 {
     switch (executionType) {
     case ASYNC_EXECUTION:
-        ASSERT(m_pendingAsyncScripts.contains(scriptLoader));
+        // RELEASE_ASSERT makes us crash in a controlled way in error cases
+        // where the ScriptLoader is associated with the wrong ScriptRunner
+        // (otherwise we'd cause a use-after-free in ~ScriptRunner when it tries
+        // to detach).
+        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(m_pendingAsyncScripts.contains(scriptLoader));
         m_pendingAsyncScripts.remove(scriptLoader);
         scriptLoader->detach();
         m_document->decrementLoadEventDelayCount();
         break;
 
     case IN_ORDER_EXECUTION:
-        ASSERT(!m_scriptsToExecuteInOrder.isEmpty());
+        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(!m_scriptsToExecuteInOrder.isEmpty());
         break;
     }
 }
 
 void ScriptRunner::movePendingAsyncScript(Document& oldDocument, Document& newDocument, ScriptLoader* scriptLoader)
 {
     RefPtrWillBeRawPtr<Document> newContextDocument = newDocument.contextDocument().get();
     if (!newContextDocument) {
         // Document's contextDocument() method will return no Document if the
         // following conditions both hold:
@@ skipping 52 matching lines @@
 {
 #if ENABLE(OILPAN)
     visitor->trace(m_document);
     visitor->trace(m_scriptsToExecuteInOrder);
     visitor->trace(m_scriptsToExecuteSoon);
     visitor->trace(m_pendingAsyncScripts);
 #endif
 }
 
 }