Consider the following reproduction CL:

https://codereview.chromium.org/2357323002/

The first call to document.write() inserts a <script> element that needs to load, so we trigger the load, but don't wait for it, instead just leave HTMLTreeBuilder::hasParserBlockingScript() and HTMLDocumentParser::isWaitingForScripts() set, and unwind.

The second call to document.write() finds that the parser still in the isWaitingForScripts() state, so it only inserts the HTML text into the HTMLInputStream, and triggers speculative parsing/preloading in the background, but does not call into HTMLDocumentParser::pumpTokenizer(), so the tree builder does not look at the script element.

Not surprisingly, the second <script> element is processed, thus loaded only after the first <script> has finished running along with all its side effects, and parsing resumes.

I will look more closely into how we are sourcing the line numbers and why it is broken in the second case.