0

Ensure cloning a template element into an inactive document does not crash.

Bug: 1092047
Test: html/semantics/scripting-1/the-template-element/template-element/template-element-clone-into-inactive-document-crash.html
Change-Id: I7d515c25294fe661781d14d53053dbf1d3be49f9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2236245
Auto-Submit: Nate Chapin <japhet@chromium.org>
Commit-Queue: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#776274}
This commit is contained in:
Nate Chapin
2020-06-08 23:54:25 +00:00
committed by Commit Bot
parent 5c6779da8b
commit b2436c3bfe
2 changed files with 8 additions and 1 deletions
third_party/blink
renderer
web_tests
external
wpt
html
semantics
scripting-1

@ -66,7 +66,7 @@ DocumentFragment* HTMLTemplateElement::DeclarativeShadowContent() const {
void HTMLTemplateElement::CloneNonAttributePropertiesFrom(
const Element& source,
CloneChildrenFlag flag) {
if (flag == CloneChildrenFlag::kSkip)
if (flag == CloneChildrenFlag::kSkip || !GetExecutionContext())
return;
DCHECK_NE(flag, CloneChildrenFlag::kCloneWithShadows);
auto& html_template_element = To<HTMLTemplateElement>(source);

@ -0,0 +1,7 @@
<template id="t"> </template>
<iframe id="i"></iframe>
<script>
var doc = i.contentDocument;
i.remove();
doc.importNode(t, true);
</script>