Sanitization should reject elements that we can't examine (e.g. embed/object on FF)

sdk/lib/html/dart2js/html_dart2js.dart

Index: sdk/lib/html/dart2js/html_dart2js.dart
diff --git a/sdk/lib/html/dart2js/html_dart2js.dart b/sdk/lib/html/dart2js/html_dart2js.dart
index c96ee3c7f5ac75b1253aa6c901c549400b458323..f163b43f4fb64454ec28d2d96e23ea6ff820932b 100644
--- a/sdk/lib/html/dart2js/html_dart2js.dart
+++ b/sdk/lib/html/dart2js/html_dart2js.dart
@@ -40799,24 +40799,49 @@ class _ValidatingTreeSanitizer implements NodeTreeSanitizer {
     switch (node.nodeType) {
       case Node.ELEMENT_NODE:
         Element element = node;
-        if (element._hasCorruptedAttributes) {
-          window.console.warn('Removing element due to corrupted attributes on <${element}>');
+        // If the _hasCorruptedAttributes does not successfully return false,
+        // then we consider it corrupted and remove.
+        // TODO(alanknight): This is a workaround because on Firefox
+        // embed/object
+        // tags typeof is "function", not "object". We don't recognize them, and
+        // can't call methods. This does mean that you can't explicitly allow an
+        // embed tag. The only thing that will let it through is a null
+        // sanitizer that doesn't traverse the tree at all. But sanitizing while
+        // allowing embeds seems quite unlikely.
+        var corrupted = true;
+        var attrs;
+        var isAttr;
+        try {
+          // If getting/indexing attributes throws, count that as corrupt.
+          attrs = element.attributes;
+          isAttr = attrs['is'];
+          corrupted = element._hasCorruptedAttributes;
+        } catch(e) {}
+        var elementText = 'element unprintable';
+        try {
+          elementText = element.toString();
+        } catch(e) {}
+        var elementTagName = 'element tag unavailable';
+        try {
+          elementTagName = element.tagName;
+        } catch(e) {}
+        if (corrupted) {
+          window.console.warn(
+              'Removing element due to corrupted attributes on <$elementText>');
           _removeNode(node, parent);
           break;
         }
-        var attrs = element.attributes;
         if (!validator.allowsElement(element)) {
           window.console.warn(
-              'Removing disallowed element <${element.tagName}>');
+              'Removing disallowed element <$elementTagName>');
           _removeNode(node, parent);
           break;
         }
 
-        var isAttr = attrs['is'];
         if (isAttr != null) {
           if (!validator.allowsAttribute(element, 'is', isAttr)) {
             window.console.warn('Removing disallowed type extension '
-                '<${element.tagName} is="$isAttr">');
+                '<$elementTagName is="$isAttr">');
             _removeNode(node, parent);
             break;
           }