Ensure cloning a template element into an inactive document does not crash.
Bug: 1092047 Test: html/semantics/scripting-1/the-template-element/template-element/template-element-clone-into-inactive-document-crash.html Change-Id: I7d515c25294fe661781d14d53053dbf1d3be49f9 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2236245 Auto-Submit: Nate Chapin <japhet@chromium.org> Commit-Queue: Kentaro Hara <haraken@chromium.org> Reviewed-by: Kentaro Hara <haraken@chromium.org> Cr-Commit-Position: refs/heads/master@{#776274}
This commit is contained in:
third_party/blink
renderer
core
web_tests
external
wpt
html
semantics
scripting-1
the-template-element
template-element
@ -66,7 +66,7 @@ DocumentFragment* HTMLTemplateElement::DeclarativeShadowContent() const {
|
||||
void HTMLTemplateElement::CloneNonAttributePropertiesFrom(
|
||||
const Element& source,
|
||||
CloneChildrenFlag flag) {
|
||||
if (flag == CloneChildrenFlag::kSkip)
|
||||
if (flag == CloneChildrenFlag::kSkip || !GetExecutionContext())
|
||||
return;
|
||||
DCHECK_NE(flag, CloneChildrenFlag::kCloneWithShadows);
|
||||
auto& html_template_element = To<HTMLTemplateElement>(source);
|
||||
|
7
third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-template-element/template-element/template-element-clone-into-inactive-document-crash.html
vendored
Normal file
7
third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-template-element/template-element/template-element-clone-into-inactive-document-crash.html
vendored
Normal file
@ -0,0 +1,7 @@
|
||||
<template id="t"> </template>
|
||||
<iframe id="i"></iframe>
|
||||
<script>
|
||||
var doc = i.contentDocument;
|
||||
i.remove();
|
||||
doc.importNode(t, true);
|
||||
</script>
|
Reference in New Issue
Block a user