StyleResolverState may not be constructed with a null element.
It is dereferenced in ElementContext. Even documentElement() may
sometimes be null. With this CL, StyleResolverState and ElementContext
are always associated with a non-null Element.
In the case where we used to pass a Document for ElementContext, or
documentElement() directly, we will now pass documentElement() if not
null or avoid using StyleResolverState if it is null.
Bug: 971035
Change-Id: If7f34556f68aa8b55f157b2fbad5c0a331869e28
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1645292
Reviewed-by: Fernando Serboncini <fserb@chromium.org>
Reviewed-by: Anders Hartvoll Ruud <andruud@chromium.org>
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#668127}
diff --git a/css/css-font-loading/fontfaceset-no-root-element.html b/css/css-font-loading/fontfaceset-no-root-element.html
new file mode 100644
index 0000000..1300191
--- /dev/null
+++ b/css/css-font-loading/fontfaceset-no-root-element.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<title>CSS Font Loading test: Load Document FontFaceSet font without documentElement</title>
+<link rel="help" href="https://drafts.csswg.org/css-font-loading/#font-face-set-load">
+<link rel="help" href="https://crbug.com/971035">
+<script>
+ test(() => {
+ document.documentElement.remove();
+ var face = new FontFace("Ahem", "url(/fonts/Ahem.ttf)");
+ document.fonts.add(face);
+ document.fonts.load("12px Ahem");
+ }, "Trigger font load after removing documentElement. Should not crash.");
+</script>
