Don't end() if XMLDocumentParser::ResumeParsing() triggers a detach

Bug: 977520 Test: http/tests/navigation/xmhtml-location-change-crash.xhtml Change-Id: Idbb8718db7de77ddf41dbc62bd102e884d0bfa12 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1674364 Commit-Queue: Nate Chapin <japhet@chromium.org> Auto-Submit: Nate Chapin <japhet@chromium.org> Reviewed-by: Daniel Cheng <dcheng@chromium.org> Cr-Commit-Position: refs/heads/master@{#671872}

Don't end() if XMLDocumentParser::ResumeParsing() triggers a detach
Bug: 977520 Test: http/tests/navigation/xmhtml-location-change-crash.xhtml Change-Id: Idbb8718db7de77ddf41dbc62bd102e884d0bfa12 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1674364 Commit-Queue: Nate Chapin <japhet@chromium.org> Auto-Submit: Nate Chapin <japhet@chromium.org> Reviewed-by: Daniel Cheng <dcheng@chromium.org> Cr-Commit-Position: refs/heads/master@{#671872}
0cc4b93b · Nate Chapin · Commit Bot · 39f15812 · 0cc4b93b · 0cc4b93b
Commit 0cc4b93b authored Jun 25, 2019 by Nate Chapin Committed by Commit Bot Jun 25, 2019
3 changed files
--- a/third_party/blink/renderer/core/xml/parser/xml_document_parser.cc
+++ b/third_party/blink/renderer/core/xml/parser/xml_document_parser.cc
@@ -1619,6 +1619,9 @@ void XMLDocumentParser::ResumeParsing() {
  // the passed string has more than one reference.
  Append(rest.ToString().Impl());

+  if (IsDetached())
+    return;
+
  // Finally, if finish() has been called and write() didn't result
  // in any further callbacks being queued, call end()
  if (finish_called_ && pending_callbacks_.IsEmpty())

--- a/third_party/blink/web_tests/http/tests/navigation/xhtml-location-change-crash-expected.txt
+++ b/third_party/blink/web_tests/http/tests/navigation/xhtml-location-change-crash-expected.txt
+PASS
--- a/third_party/blink/web_tests/http/tests/navigation/xhtml-location-change-crash.xhtml
+++ b/third_party/blink/web_tests/http/tests/navigation/xhtml-location-change-crash.xhtml
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html>
+<html lang="fr" xml:lang="fr" xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript" src="../resources/dummy.js"/>
+</head>
+<body>
+<script type="text/javascript">
+if (window.testRunner) {
+  testRunner.dumpAsText();
+  testRunner.waitUntilDone();
+}
+window.location = "resources/pass-and-notify-done.html";
+</script>
+</body>
+</html>