Handle null GetExecutionContext() in LinkStyle::Process

Bug: 1139708 Test: http/tests/misc/favicon-link-in-detached-frame.html Change-Id: Ie6428708a3ea3dd80abad835deff189deeeedb28 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2504577 Commit-Queue: Kentaro Hara <haraken@chromium.org> Auto-Submit: Nate Chapin <japhet@chromium.org> Reviewed-by: Kentaro Hara <haraken@chromium.org> Cr-Commit-Position: refs/heads/master@{#821736}

Handle null GetExecutionContext() in LinkStyle::Process
Bug: 1139708 Test: http/tests/misc/favicon-link-in-detached-frame.html Change-Id: Ie6428708a3ea3dd80abad835deff189deeeedb28 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2504577 Commit-Queue: Kentaro Hara <haraken@chromium.org> Auto-Submit: Nate Chapin <japhet@chromium.org> Reviewed-by: Kentaro Hara <haraken@chromium.org> Cr-Commit-Position: refs/heads/master@{#821736}
343955c1 · Nate Chapin · Commit Bot · bc42696a · 343955c1 · 343955c1
Commit 343955c1 authored Oct 28, 2020 by Nate Chapin Committed by Commit Bot Oct 28, 2020
3 changed files
--- a/third_party/blink/renderer/core/html/link_style.cc
+++ b/third_party/blink/renderer/core/html/link_style.cc
@@ -335,6 +335,8 @@ void LinkStyle::Process() {
      params.href.IsValid() && !params.href.IsEmpty()) {
    if (!owner_->ShouldLoadLink())
      return;
+    if (!GetExecutionContext())
+      return;
    if (!GetExecutionContext()->GetSecurityOrigin()->CanDisplay(params.href))
      return;
    if (!GetExecutionContext()

--- a/third_party/blink/web_tests/http/tests/misc/favicon-link-in-detached-frame-expected.txt
+++ b/third_party/blink/web_tests/http/tests/misc/favicon-link-in-detached-frame-expected.txt
+CONSOLE MESSAGE: line 8: PASS if no crash.
+
--- a/third_party/blink/web_tests/http/tests/misc/favicon-link-in-detached-frame.html
+++ b/third_party/blink/web_tests/http/tests/misc/favicon-link-in-detached-frame.html
+<body>
+<link rel="icon stylesheet" href="foo"></link>
+<iframe id="i"></iframe>
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+i.contentDocument.documentElement.appendChild(document.body);
+console.log("PASS if no crash.");
+</script>