node-set($x), when $x is empty, should not halt XSLT processing

third_party/WebKit/Source/core/xml/XSLTExtensions.cpp

Index: third_party/WebKit/Source/core/xml/XSLTExtensions.cpp
diff --git a/third_party/WebKit/Source/core/xml/XSLTExtensions.cpp b/third_party/WebKit/Source/core/xml/XSLTExtensions.cpp
index 00a420e06a26dcc82445c7779ee79df52b3e7751..e208030839a2f9590cb74125c58edf3c86ed2bd8 100644
--- a/third_party/WebKit/Source/core/xml/XSLTExtensions.cpp
+++ b/third_party/WebKit/Source/core/xml/XSLTExtensions.cpp
@@ -52,14 +52,21 @@ static void exsltNodeSetFunction(xmlXPathParserContextPtr ctxt, int nargs) {
     return;
   }
 
-  strval = xmlXPathPopString(ctxt);
-  retNode = xmlNewDocText(0, strval);
-  ret = xmlXPathNewValueTree(retNode);
+  // node-set can also take a string and turn it into a singleton node
+  // set with one text node. This may null-deref if allocating the
+  // document, text node, etc. fails; that behavior is expected.
+
+  // Create a document to hold the text node result.
+  xsltTransformContextPtr tctxt = xsltXPathGetTransformContext(ctxt);
+  xmlDocPtr fragment = xsltCreateRVT(tctxt);
+  xsltRegisterLocalRVT(tctxt, fragment);
 
-  // FIXME: It might be helpful to push any errors from xmlXPathNewValueTree
-  // up to the Javascript Console.
-  if (ret)
-    ret->type = XPATH_NODESET;
+  // Create the text node and wrap it in a result set.
+  strval = xmlXPathPopString(ctxt);
+  retNode = xmlNewDocText(fragment, strval);
+  xmlAddChild(reinterpret_cast<xmlNodePtr>(fragment), retNode);
+  ret = xmlXPathNewNodeSet(retNode);
+  CHECK(ret);
 
   if (strval)
     xmlFree(strval);