Calling the KeyframeEffect constructor with an element from a detached Document should not crash.

Bug: 103246
Test: fast/animation/keyframe-constructor-with-elemeent-from-inactive-document.html
Change-Id: I775fd24b0790bb9e425347ee67360430c22c79ea
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2290312
Commit-Queue: Kentaro Hara <haraken@chromium.org>
Auto-Submit: Nate Chapin <japhet@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#787034}

third_party/blink/renderer/core/animation/effect_input.cc

@@ -90,17 +90,19 @@ void SetKeyframeValue(Element* element,
   StyleSheetContents* style_sheet_contents = document.ElementSheet().Contents();
   CSSPropertyID css_property =
       AnimationInputHelpers::KeyframeAttributeToCSSProperty(property, document);
+  SecureContextMode secure_context_mode =
+      document.GetExecutionContext()
+          ? document.GetExecutionContext()->GetSecureContextMode()
+          : SecureContextMode::kInsecureContext;
   if (css_property != CSSPropertyID::kInvalid) {
     MutableCSSPropertyValueSet::SetResult set_result =
         css_property == CSSPropertyID::kVariable
-            ? keyframe.SetCSSPropertyValue(
-                  AtomicString(property), value,
-                  document.GetExecutionContext()->GetSecureContextMode(),
-                  style_sheet_contents)
-            : keyframe.SetCSSPropertyValue(
-                  css_property, value,
-                  document.GetExecutionContext()->GetSecureContextMode(),
-                  style_sheet_contents);
+            ? keyframe.SetCSSPropertyValue(AtomicString(property), value,
+                                           secure_context_mode,
+                                           style_sheet_contents)
+            : keyframe.SetCSSPropertyValue(css_property, value,
+                                           secure_context_mode,
+                                           style_sheet_contents);
     if (!set_result.did_parse && execution_context) {
       if (document.GetFrame()) {
         document.GetFrame()->Console().AddMessage(
@@ -117,10 +119,9 @@ void SetKeyframeValue(Element* element,
       AnimationInputHelpers::KeyframeAttributeToPresentationAttribute(property,
                                                                       element);
   if (css_property != CSSPropertyID::kInvalid) {
-    keyframe.SetPresentationAttributeValue(
-        CSSProperty::Get(css_property), value,
-        document.GetExecutionContext()->GetSecureContextMode(),
-        style_sheet_contents);
+    keyframe.SetPresentationAttributeValue(CSSProperty::Get(css_property),
+                                           value, secure_context_mode,
+                                           style_sheet_contents);
     return;
   }
   const QualifiedName* svg_attribute =

third_party/blink/web_tests/fast/animation/keyframe-constructor-with-element-from-inactive-document-expected.txt

+PASS if no crash.

third_party/blink/web_tests/fast/animation/keyframe-constructor-with-element-from-inactive-document.html

+<iframe id="i"></iframe>
+PASS if no crash.
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+var el = i.contentDocument.documentElement;
+i.remove();
+new KeyframeEffect(el, [{left: '1px'}]); 
+</script>