Bug 1350049: Handle nsParser being finalized before resuming. r=hsivonen

This is a hybrid of the previous two approaches. The nsParser weak reference
sometimes stays alive after it's been detached from the document, after which
attempting to remove it throws. This stores a reference to the original
parser, and checks that it's still the current parser when it comes time to
resume.

MozReview-Commit-ID: 1JSi2FmPxt0

--HG--
extra : rebase_source : fc29ab7cd2074eda5f2c747ff7255a29bcc6f4a2

dom/base/nsDocument.cpp

@@ -10554,6 +10554,7 @@ public:
     if (parser) {
       parser->BlockParser();
       mParser = do_GetWeakReference(parser);
+      mDocument = aDocument;
     }
   }
 
@@ -10583,17 +10584,23 @@ private:
   void MaybeUnblockParser() {
     nsCOMPtr<nsIParser> parser = do_QueryReferent(mParser);
     if (parser) {
-      parser->UnblockParser();
-      parser->ContinueInterruptedParsingAsync();
-      mParser = nullptr;
+      MOZ_ASSERT(mDocument);
+      nsCOMPtr<nsIParser> docParser = mDocument->CreatorParserOrNull();
+      if (parser == docParser) {
+        parser->UnblockParser();
+        parser->ContinueInterruptedParsingAsync();
+      }
     }
+    mParser = nullptr;
+    mDocument = nullptr;
   }
 
   nsWeakPtr mParser;
   RefPtr<Promise> mPromise;
+  RefPtr<nsIDocument> mDocument;
 };
 
-NS_IMPL_CYCLE_COLLECTION(UnblockParsingPromiseHandler, mPromise)
+NS_IMPL_CYCLE_COLLECTION(UnblockParsingPromiseHandler, mDocument, mPromise)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(UnblockParsingPromiseHandler)
   NS_INTERFACE_MAP_ENTRY(nsISupports)

parser/htmlparser/nsParser.cpp

@@ -682,7 +682,10 @@ nsParser::UnblockParser()
 NS_IMETHODIMP_(void)
 nsParser::ContinueInterruptedParsingAsync()
 {
-  mSink->ContinueInterruptedParsingAsync();
+  MOZ_ASSERT(mSink);
+  if (MOZ_LIKELY(mSink)) {
+    mSink->ContinueInterruptedParsingAsync();
+  }
 }
 
 /**