Bug 1716674 [wpt PR 29393] - Fix use-after-free with XSLT strip-space, a=testonly

Automatic update from web-platform-tests
Fix use-after-free with XSLT strip-space

Fixed: 1219209
Change-Id: I3baab9d1b419407d964a80f10c6ca05e0294554f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2965632
Commit-Queue: Joey Arhar <jarhar@chromium.org>
Reviewed-by: Stephen Chenney <schenney@chromium.org>
Cr-Commit-Position: refs/heads/master@{#892861}

--

wpt-commits: 3e3b873f7c571a4e2d1c890c0c8a9840237e23ee
wpt-pr: 29393

testing/web-platform/tests/xslt/strip-space-crash.xml

@@ -0,0 +1,33 @@
+<?xml-stylesheet type="text/xsl" href="#style"?>
+<xsl:stylesheet
+    version="1.0"
+    xml:id="style"
+    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+    xmlns:exsl="http://exslt.org/common"
+    extension-element-prefixes="exsl"
+>
+    <xsl:strip-space elements="s"/>
+
+    <xsl:template match="/">
+        <xsl:variable name="space">
+            <s>
+                <xsl:text> </xsl:text>
+                <e/>
+                <xsl:text> </xsl:text>
+                <e/>
+                <xsl:text> </xsl:text>
+            </s>
+        </xsl:variable>
+        <xsl:apply-templates select="exsl:node-set($space)/s"/>
+    </xsl:template>
+
+    <xsl:template match="s">
+        <r>
+            <xsl:variable name="text-nodes" select="text()"/>
+            <xsl:apply-templates/>
+            <xsl:copy-of select="$text-nodes"/>
+        </r>
+    </xsl:template>
+
+    <xsl:template match="node()"/>
+</xsl:stylesheet>