Ensure cloning a template element into an inactive document does not crash.

Bug: 1092047
Test: html/semantics/scripting-1/the-template-element/template-element/template-element-clone-into-inactive-document-crash.html
Change-Id: I7d515c25294fe661781d14d53053dbf1d3be49f9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2236245
Auto-Submit: Nate Chapin <japhet@chromium.org>
Commit-Queue: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#776274}

third_party/blink/renderer/core/html/html_template_element.cc

@@ -66,7 +66,7 @@ DocumentFragment* HTMLTemplateElement::DeclarativeShadowContent() const {
 void HTMLTemplateElement::CloneNonAttributePropertiesFrom(
     const Element& source,
     CloneChildrenFlag flag) {
-  if (flag == CloneChildrenFlag::kSkip)
+  if (flag == CloneChildrenFlag::kSkip || !GetExecutionContext())
     return;
   DCHECK_NE(flag, CloneChildrenFlag::kCloneWithShadows);
   auto& html_template_element = To<HTMLTemplateElement>(source);

third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-template-element/template-element/template-element-clone-into-inactive-document-crash.html

+<template id="t"> </template>
+<iframe id="i"></iframe>
+<script>
+var doc = i.contentDocument;
+i.remove();
+doc.importNode(t, true);
+</script>