Don't allow scripts to run when a node is being adopted.

third_party/WebKit/Source/core/dom/TreeScope.cpp

 /*
  * Copyright (C) 2011 Google Inc. All Rights Reserved.
  * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 355 matching lines @@
         }
     }
     return nullptr;
 }
 
 void TreeScope::adoptIfNeeded(Node& node)
 {
     DCHECK(this);
     DCHECK(!node.isDocumentNode());
     TreeScopeAdopter adopter(node, *this);
-    if (adopter.needsScopeChange())
+    if (adopter.needsScopeChange()) {
+        ScriptForbiddenScope forbidScript;

[esprehn, 2016/04/25 20:55:22]

This should be at the top of the function. ScriptForbiddenScope is like an
assert, needsScopeChange() should be able to run script either.

         adopter.execute();
+    }
 }
 
 Element* TreeScope::retarget(const Element& target) const
 {
     for (const Element* ancestor = ⌖ ancestor; ancestor = ancestor->shadowHost()) {
         if (this == ancestor->treeScope())
             return const_cast<Element*>(ancestor);
     }
     return nullptr;
 }
@@ skipping 142 matching lines @@
     visitor->trace(m_idTargetObserverRegistry);
     visitor->trace(m_selection);
     visitor->trace(m_elementsById);
     visitor->trace(m_imageMapsByName);
     visitor->trace(m_labelsByForAttribute);
     visitor->trace(m_scopedStyleResolver);
     visitor->trace(m_radioButtonGroupScope);
 }
 
 } // namespace blink