Ensure cloning a template element into an inactive document does not …

…crash. Bug: 1092047 Test: html/semantics/scripting-1/the-template-element/template-element/template-element-clone-into-inactive-document-crash.html Change-Id: I7d515c25294fe661781d14d53053dbf1d3be49f9 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2236245 Auto-Submit: Nate Chapin <japhet@chromium.org> Commit-Queue: Kentaro Hara <haraken@chromium.org> Reviewed-by: Kentaro Hara <haraken@chromium.org> Cr-Commit-Position: refs/heads/master@{#776274}
marcosholgado · Jun 8, 2020 · b2436c3 · b2436c3
1 parent 5c6779d
commit b2436c3
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/third_party/blink/renderer/core/html/html_template_element.cc b/third_party/blink/renderer/core/html/html_template_element.cc
@@ -66,7 +66,7 @@ DocumentFragment* HTMLTemplateElement::DeclarativeShadowContent() const {
 void HTMLTemplateElement::CloneNonAttributePropertiesFrom(
     const Element& source,
     CloneChildrenFlag flag) {
-  if (flag == CloneChildrenFlag::kSkip)
+  if (flag == CloneChildrenFlag::kSkip || !GetExecutionContext())
     return;
   DCHECK_NE(flag, CloneChildrenFlag::kCloneWithShadows);
   auto& html_template_element = To<HTMLTemplateElement>(source);

diff --git a/...emplate-element/template-element/template-element-clone-into-inactive-document-crash.html b/...emplate-element/template-element/template-element-clone-into-inactive-document-crash.html
@@ -0,0 +1,7 @@
+<template id="t"> </template>
+<iframe id="i"></iframe>
+<script>
+var doc = i.contentDocument;
+i.remove();
+doc.importNode(t, true);
+</script>