commit d64dfe8d219ed245f5ca01712abd54ede333df2d
author Antonio Sartori <antoniosartori@google.com> Thu May 27 08:48:45 2021
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Thu May 27 08:48:45 2021
tree bb2c144404ecd1864dfb947c7d341195e864e32c
parent a6890ebc4a5b8df4e448fa2da5489af71cb1f41e

[PolicyContainer] Fix nullptr dereference

When committing a Javascript or a XSLT document, we must reuse the
policy container of the previous document.

In Blink, the `PolicyContainer` is attached to the `ExecutionContext`.
When committing a Javascript/XSLT document, a new `ExecutionContext`
for the new document is created, and we used to move the
`PolicyContainer` from the previous `ExecutionContext` into the new
one. This left the previous `ExecutionContext` without
`PolicyContainer`, and calling, for example,
`ExecutionContext::GetReferrerPolicy()` would trigger a nullptr
dereference.

It was my belief that the old `ExecutionContext` would not be used
anymore. However, this is not true. The test included in this CL shows
how `ExecutionContext::GetReferrerPolicy()` can actually be triggered
for the old `ExecutionContext`.

With this CL, we create a new `PolicyContainer` for the old
`ExecutionContext` with a copy of the previous policies. The new
`PolicyContainer` has no corresponding `PolicyContainerHost`. In fact,
any corresponding document should be detached and in practice this
`ExecutionContext` should be useless. However, having a valid
`PolicyContainer` avoids the need of nullptr checks.

Bug: 1196372
Change-Id: I2d234ced4e30ddce80c2b3fb571fe0aa8a651d90
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2896901
Commit-Queue: Antonio Sartori <antoniosartori@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Cr-Commit-Position: refs/heads/master@{#887080}