Don't allow scripts to run when a node is being adopted.

third_party/WebKit/Source/core/dom/TreeScope.cpp

Index: third_party/WebKit/Source/core/dom/TreeScope.cpp
diff --git a/third_party/WebKit/Source/core/dom/TreeScope.cpp b/third_party/WebKit/Source/core/dom/TreeScope.cpp
index 377a865ee6e8271511f83d8517eb7513d65f4c6b..2d1a1b6ee5785db7a5b02c61938eccb91f118cdc 100644
--- a/third_party/WebKit/Source/core/dom/TreeScope.cpp
+++ b/third_party/WebKit/Source/core/dom/TreeScope.cpp
@@ -373,8 +373,10 @@ void TreeScope::adoptIfNeeded(Node& node)
     DCHECK(this);
     DCHECK(!node.isDocumentNode());
     TreeScopeAdopter adopter(node, *this);
-    if (adopter.needsScopeChange())
+    if (adopter.needsScopeChange()) {
+        ScriptForbiddenScope forbidScript;

[esprehn, 2016/04/25 20:55:22]

This should be at the top of the function. ScriptForbiddenScope is like an
assert, needsScopeChange() should be able to run script either.

         adopter.execute();
+    }
 }
 
 Element* TreeScope::retarget(const Element& target) const