Fix detached event listener attribute updating.

The parser will in some cases create new elements in documents that have become frame-detached. Account for that -- no execution context due to the document having become detached -- when processing the event listeners of an event attribute. R=haraken BUG=714353 Review-Url: https://codereview.chromium.org/2855443002 Cr-Commit-Position: refs/heads/master@{#468294}

Fix detached event listener attribute updating.
The parser will in some cases create new elements in documents that have become frame-detached. Account for that -- no execution context due to the document having become detached -- when processing the event listeners of an event attribute. R=haraken BUG=714353 Review-Url: https://codereview.chromium.org/2855443002 Cr-Commit-Position: refs/heads/master@{#468294}
3c689934 · sigbjornf · Commit bot · e8abebbc · 3c689934 · 3c689934
Commit 3c689934 authored Apr 30, 2017 by sigbjornf Committed by Commit bot May 01, 2017
2 changed files
--- a/third_party/WebKit/LayoutTests/fast/events/event-listener-detached.html
+++ b/third_party/WebKit/LayoutTests/fast/events/event-listener-detached.html
+<!DOCTYPE html>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script>
+var t = async_test("Updating attributes for detached nodes should not crash.");
+function test() {
+  frame.contentDocument.adoptNode(document.scrollingElement);
+  t.done();
+}
+</script>
+<iframe id="frame" onload="test()"></iframe>
+<div ontransitionend="g()" onwebkittransitionend="h()">
--- a/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp
@@ -204,7 +204,8 @@ bool V8AbstractEventListener::BelongsToTheCurrentWorld(
    return true;
  // If currently parsing, the parser could be accessing this listener
  // outside of any v8 context; check if it belongs to the main world.
-  if (!GetIsolate()->InContext() && execution_context->IsDocument()) {
+  if (!GetIsolate()->InContext() && execution_context &&
+      execution_context->IsDocument()) {
    Document* document = ToDocument(execution_context);
    if (document->Parser() && document->Parser()->IsParsing())
      return World().IsMainWorld();