Skip to content

GitLab

T
tangled
Commit 2276495f authored by Nate Chapin's avatar Nate Chapin Committed by Commit Bot
Browse files
Options

Fix crash due to null context document in GetStringFromScriptHelper() 

Bug: 1052723
Test: fast/dom/HTMLScriptElement/script-append-child-in-detached-document.html
Change-Id: Id1f0ad773644cbc3d5c0b5f556070c2d257a331b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2070957
Commit-Queue: Kentaro Hara <haraken@chromium.org>
Auto-Submit: Nate Chapin <japhet@chromium.org>
Reviewed-by: default avatarKentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#744146}
parent 23233aea
Hide whitespace changes
Inline Side-by-side
Showing with 17 additions and 0 deletions
third_party/blink/renderer/core/trustedtypes/trusted_types_util.cc
View file @ 2276495f
...@@ -164,6 +164,8 @@ String GetStringFromScriptHelper( ...@@ -164,6 +164,8 @@ String GetStringFromScriptHelper(
const char* attribute_name_for_exception, const char* attribute_name_for_exception,
TrustedTypeViolationKind violation_kind, TrustedTypeViolationKind violation_kind,
TrustedTypeViolationKind violation_kind_when_default_policy_failed) { TrustedTypeViolationKind violation_kind_when_default_policy_failed) {
if (!doc)
return script;
bool require_trusted_type = bool require_trusted_type =
RequireTrustedTypesCheck(doc->ToExecutionContext()); RequireTrustedTypesCheck(doc->ToExecutionContext());
if (!require_trusted_type) if (!require_trusted_type)
......
third_party/blink/web_tests/fast/dom/HTMLScriptElement/script-append-child-in-detached-document.html 0 → 100644
View file @ 2276495f
<!DOCTYPE html>
<body>
<iframe id="i" src="about:blank"></iframe>
<script>
if (window.testRunner)
testRunner.dumpAsText();
var i_doc = i.contentDocument;
i.remove();
var script = i_doc.createElement("script");
script.appendChild(i_doc.createTextNode("foo"));
i_doc.body.appendChild(script);
</script>
<p>PASS unless crash</p>
</body>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment