<marquee> in <template> should not crash

Source/core/html/HTMLMarqueeElement.cpp

Index: Source/core/html/HTMLMarqueeElement.cpp
diff --git a/Source/core/html/HTMLMarqueeElement.cpp b/Source/core/html/HTMLMarqueeElement.cpp
index b53c7f06994733e74876b4b0b2fbc69eababc747..eda3ec333be45eaada7d8ad419ece5382f9e4dc2 100644
--- a/Source/core/html/HTMLMarqueeElement.cpp
+++ b/Source/core/html/HTMLMarqueeElement.cpp
@@ -33,17 +33,16 @@ namespace blink {
 
 inline HTMLMarqueeElement::HTMLMarqueeElement(Document& document)
     : HTMLElement(HTMLNames::marqueeTag, document)
+    , m_didCallCreatedCallback(false)
 {
-    v8::Handle<v8::Value> classObject = PrivateScriptRunner::installClassIfNeeded(document.frame(), "HTMLMarqueeElement");
-    RELEASE_ASSERT(!classObject.IsEmpty());
     UseCounter::count(document, UseCounter::HTMLMarqueeElement);
 }
 
 PassRefPtrWillBeRawPtr<HTMLMarqueeElement> HTMLMarqueeElement::create(Document& document)
 {
-    RefPtrWillBeRawPtr<HTMLMarqueeElement> marqueeElement(adoptRefWillBeNoop(new HTMLMarqueeElement(document)));
-    V8HTMLMarqueeElement::PrivateScript::createdCallbackMethod(document.frame(), marqueeElement.get());
-    return marqueeElement.release();
+    RefPtr<HTMLMarqueeElement> element = adoptRefWillBeNoop(new HTMLMarqueeElement(document));
+    element->callCreatedCallbackIfNeeded();
+    return element.release();
 }
 
 void HTMLMarqueeElement::attributeWillChange(const QualifiedName& name, const AtomicString& oldValue, const AtomicString& newValue)
@@ -55,18 +54,38 @@ void HTMLMarqueeElement::attributeWillChange(const QualifiedName& name, const At
 Node::InsertionNotificationRequest HTMLMarqueeElement::insertedInto(ContainerNode* insertionPoint)
 {
     HTMLElement::insertedInto(insertionPoint);
-    if (inDocument()) {
-        V8HTMLMarqueeElement::PrivateScript::attachedCallbackMethod(document().frame(), this);
-    }
+    if (inDocument())
+        return InsertionShouldCallDidNotifySubtreeInsertions;
     return InsertionDone;
 }
 
+void HTMLMarqueeElement::didNotifySubtreeInsertionsToDocument()
+{
+    callCreatedCallbackIfNeeded();
+    V8HTMLMarqueeElement::PrivateScript::attachedCallbackMethod(document().frame(), this);
+}
+
 void HTMLMarqueeElement::removedFrom(ContainerNode* insertionPoint)
 {
     HTMLElement::removedFrom(insertionPoint);
     if (insertionPoint->inDocument()) {
+        ASSERT(m_didCallCreatedCallback);
         V8HTMLMarqueeElement::PrivateScript::detachedCallbackMethod(insertionPoint->document().frame(), this);
     }
 }
 
+void HTMLMarqueeElement::callCreatedCallbackIfNeeded()
+{
+    if (m_didCallCreatedCallback)
+        return;
+    // document().frame() can return 0 if this marquee element is placed in
+    // a template element. In this case we need to defer the execution of the
+    // private script to the point where the frame gets available.
+    if (!document().frame())
+        return;
+
+    V8HTMLMarqueeElement::PrivateScript::createdCallbackMethod(document().frame(), this);
+    m_didCallCreatedCallback = true;
+}
+
 } // namespace blink