GN: Don't allow nested things inside template invocations.

tools/gn/template.cc

Index: tools/gn/template.cc
diff --git a/tools/gn/template.cc b/tools/gn/template.cc
index 80d6c5cf74843772dce9c9c428248c5d33f195ba..3d58b9a7eb010df9c650f80d4815f3fc74ec18ff 100644
--- a/tools/gn/template.cc
+++ b/tools/gn/template.cc
@@ -41,9 +41,20 @@ Value Template::Invoke(Scope* scope,
                             invocation->function().value().as_string(),
                             block, args, invocation_scope.get(), err))
     return Value();
-  block->Execute(invocation_scope.get(), err);
-  if (err->has_error())
-    return Value();
+
+  {
+    // Don't allow the block of the template invocation to include other
+    // targets configs, or template invocations. This must only be applied
+    // to the invoker's block rather than the whole function because the
+    // template execution itself must be able to define targets, etc.
+    NonNestableBlock non_nestable(scope, invocation, "template invocation");
+    if (!non_nestable.Enter(err))
+      return Value();
+
+    block->Execute(invocation_scope.get(), err);
+    if (err->has_error())
+      return Value();
+  }
 
   // Set up the scope to run the template and set the current directory for the
   // template (which ScopePerFileProvider uses to base the target-related