diff --git a/third_party/blink/renderer/core/loader/document_loader.cc b/third_party/blink/renderer/core/loader/document_loader.cc
index eed944992965d..95c4a30e0bb60 100644
--- a/third_party/blink/renderer/core/loader/document_loader.cc
+++ b/third_party/blink/renderer/core/loader/document_loader.cc
@@ -1898,15 +1898,22 @@ void DocumentLoader::ProcessDataBuffer(BodyData* data) {
   // of CommitData() may queue more data in reentrant invocations, so iterate
   // until it's empty.
   DCHECK(data_buffer_->empty() || decoded_data_buffer_.empty());
-  for (const auto& span : *data_buffer_) {
-    EncodedBodyData body_data(span);
-    CommitData(body_data);
+  // CommitData() can synchronously execute script (XML parser inline <script>)
+  // which, via ScopedPagePauser dtor -> SetDefersLoading(kNone) ->
+  // NavigationBodyLoader::OnReadable, can re-enter ProcessDataBuffer() and
+  // Append() to |data_buffer_|, reallocating its segment vector and dangling a
+  // range-for iterator. Swap to a local before iterating so reentrant Appends
+  // land in a fresh buffer.
+  while (!data_buffer_->empty()) {
+    scoped_refptr<SharedBuffer> committing = std::move(data_buffer_);
+    data_buffer_ = SharedBuffer::Create();
+    for (const auto& span : *committing) {
+      EncodedBodyData body_data(span);
+      CommitData(body_data);
+    }
   }
   for (auto& decoded_data : decoded_data_buffer_)
     CommitData(decoded_data);
-
-  // All data has been consumed, so flush the buffer.
-  data_buffer_->Clear();
   decoded_data_buffer_.clear();
 }