<marquee> in <template> should not crash

Source/core/html/HTMLMarqueeElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2007, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 15 matching lines @@
 #include "bindings/core/v8/PrivateScriptRunner.h"
 #include "bindings/core/v8/V8HTMLMarqueeElement.h"
 #include "core/HTMLNames.h"
 #include "core/dom/Document.h"
 #include "core/frame/UseCounter.h"
 
 namespace blink {
 
 inline HTMLMarqueeElement::HTMLMarqueeElement(Document& document)
     : HTMLElement(HTMLNames::marqueeTag, document)
+    , m_didCallCreatedCallback(false)
 {
-    v8::Handle<v8::Value> classObject = PrivateScriptRunner::installClassIfNeeded(document.frame(), "HTMLMarqueeElement");
-    RELEASE_ASSERT(!classObject.IsEmpty());
     UseCounter::count(document, UseCounter::HTMLMarqueeElement);
 }
 
 PassRefPtrWillBeRawPtr<HTMLMarqueeElement> HTMLMarqueeElement::create(Document& document)
 {
-    RefPtrWillBeRawPtr<HTMLMarqueeElement> marqueeElement(adoptRefWillBeNoop(new HTMLMarqueeElement(document)));
-    V8HTMLMarqueeElement::PrivateScript::createdCallbackMethod(document.frame(), marqueeElement.get());
-    return marqueeElement.release();
+    RefPtr<HTMLMarqueeElement> element = adoptRefWillBeNoop(new HTMLMarqueeElement(document));
+    element->callCreatedCallbackIfNeeded();
+    return element.release();
 }
 
 void HTMLMarqueeElement::attributeWillChange(const QualifiedName& name, const AtomicString& oldValue, const AtomicString& newValue)
 {
     HTMLElement::attributeWillChange(name, oldValue, newValue);
     V8HTMLMarqueeElement::PrivateScript::attributeChangedCallbackMethod(document().frame(), this, name.toString(), oldValue, newValue);
 }
 
 Node::InsertionNotificationRequest HTMLMarqueeElement::insertedInto(ContainerNode* insertionPoint)
 {
     HTMLElement::insertedInto(insertionPoint);
-    if (inDocument()) {
-        V8HTMLMarqueeElement::PrivateScript::attachedCallbackMethod(document().frame(), this);
-    }
+    if (inDocument())
+        return InsertionShouldCallDidNotifySubtreeInsertions;
     return InsertionDone;
 }
 
+void HTMLMarqueeElement::didNotifySubtreeInsertionsToDocument()
+{
+    callCreatedCallbackIfNeeded();
+    V8HTMLMarqueeElement::PrivateScript::attachedCallbackMethod(document().frame(), this);
+}
+
 void HTMLMarqueeElement::removedFrom(ContainerNode* insertionPoint)
 {
     HTMLElement::removedFrom(insertionPoint);
     if (insertionPoint->inDocument()) {
+        ASSERT(m_didCallCreatedCallback);
         V8HTMLMarqueeElement::PrivateScript::detachedCallbackMethod(insertionPoint->document().frame(), this);
     }
 }
 
+void HTMLMarqueeElement::callCreatedCallbackIfNeeded()
+{
+    if (m_didCallCreatedCallback)
+        return;
+    // document().frame() can return 0 if this marquee element is placed in
+    // a template element. In this case we need to defer the execution of the
+    // private script to the point where the frame gets available.
+    if (!document().frame())
+        return;
+
+    V8HTMLMarqueeElement::PrivateScript::createdCallbackMethod(document().frame(), this);
+    m_didCallCreatedCallback = true;
+}
+
 } // namespace blink