[Trusted Types] Gracefully handle detached documents.

This is a purely speculatively fix for an item reported by fuzzers, but not
(easily) reproducible. See bug for details.

Bug: 970282
Change-Id: I5b04cbe5b6e8b5fe2013aaf1a0e9b2f34c4f607b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1742087Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#685515}

third_party/blink/renderer/core/trustedtypes/trusted_type_policy_factory.cc

@@ -25,9 +25,15 @@ TrustedTypePolicy* TrustedTypePolicyFactory::createPolicy(
     const TrustedTypePolicyOptions* policy_options,
     bool exposed,
     ExceptionState& exception_state) {
+  if (!GetExecutionContext()) {
+    exception_state.ThrowDOMException(DOMExceptionCode::kInvalidStateError,
+                                      "The document is detached.");
+    return nullptr;
+  }
   UseCounter::Count(GetExecutionContext(),
                     WebFeature::kTrustedTypesCreatePolicy);
   if (RuntimeEnabledFeatures::TrustedDOMTypesEnabled(GetExecutionContext()) &&
+      GetExecutionContext()->GetContentSecurityPolicy() &&
       !GetExecutionContext()
            ->GetContentSecurityPolicy()
            ->AllowTrustedTypePolicy(policy_name)) {