ScriptRunner: ASSERT -> RELEASE_ASSERT.

Source/core/dom/ScriptRunner.cpp

Index: Source/core/dom/ScriptRunner.cpp
diff --git a/Source/core/dom/ScriptRunner.cpp b/Source/core/dom/ScriptRunner.cpp
index 88ed1e1c360659213e8affaf7f2ffebd37670c3f..cc987c65e46cbe63a6535f8cbe99b810a43965b6 100644
--- a/Source/core/dom/ScriptRunner.cpp
+++ b/Source/core/dom/ScriptRunner.cpp
@@ -90,13 +90,17 @@ void ScriptRunner::notifyScriptReady(ScriptLoader* scriptLoader, ExecutionType e
 {
     switch (executionType) {
     case ASYNC_EXECUTION:
-        ASSERT(m_pendingAsyncScripts.contains(scriptLoader));
+        // RELEASE_ASSERT makes us crash in a controlled way in error cases
+        // where the ScriptLoader is associated with the wrong ScriptRunner
+        // (otherwise we'd cause a use-after-free in ~ScriptRunner when it tries
+        // to detach).
+        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(m_pendingAsyncScripts.contains(scriptLoader));
         m_scriptsToExecuteSoon.append(scriptLoader);
         m_pendingAsyncScripts.remove(scriptLoader);
         break;
 
     case IN_ORDER_EXECUTION:
-        ASSERT(!m_scriptsToExecuteInOrder.isEmpty());
+        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(!m_scriptsToExecuteInOrder.isEmpty());
         break;
     }
     m_timer.startOneShot(0, FROM_HERE);
@@ -106,14 +110,18 @@ void ScriptRunner::notifyScriptLoadError(ScriptLoader* scriptLoader, ExecutionTy
 {
     switch (executionType) {
     case ASYNC_EXECUTION:
-        ASSERT(m_pendingAsyncScripts.contains(scriptLoader));
+        // RELEASE_ASSERT makes us crash in a controlled way in error cases
+        // where the ScriptLoader is associated with the wrong ScriptRunner
+        // (otherwise we'd cause a use-after-free in ~ScriptRunner when it tries
+        // to detach).
+        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(m_pendingAsyncScripts.contains(scriptLoader));
         m_pendingAsyncScripts.remove(scriptLoader);
         scriptLoader->detach();
         m_document->decrementLoadEventDelayCount();
         break;
 
     case IN_ORDER_EXECUTION:
-        ASSERT(!m_scriptsToExecuteInOrder.isEmpty());
+        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(!m_scriptsToExecuteInOrder.isEmpty());
         break;
     }
 }