WebCore:

WebCore:

        Reviewed by Darin, landed by Beth.

        - fixed http://bugs.webkit.org/show_bug.cgi?id=15765

        The call to HTMLTokenizer::write might result in a call to ::end which will invoke
        HTMLParser::finished() or Document::finishedParsing(). HTMLParser::finished() will eventually
        call Document::finishedParsing. The Document will delete the calling HTMLTokenizer and from the deleted
        tokenizer we will call into FrameLoader::tokenizerProcessedData.
        -) FrameLoader::tokenizerProcessedData calls FrameLoader::checkCompleted which gets called from the Document::finishedParsing
           (FrameLoader::finishedParsing).

        * html/HTMLTokenizer.cpp:
        (WebCore::HTMLTokenizer::timerFired):

LayoutTests:

        Reviewed by Darin, landed by Beth.

        -test for http://bugs.webkit.org/show_bug.cgi?id=15765
        Gmail hitting an assert in FrameLoader::tokenizerProcessedData

        * http/tests/loading/gmail-assert-on-load-expected.txt: Added.
        * http/tests/loading/gmail-assert-on-load.html: Added.
        * http/tests/loading/resources/gmail-assert-on-load-frame.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@29655 268f45cc-cd09-0410-ab3c-d52691b4dbfc