Don't allow scripts to run when a node is being adopted.

third_party/WebKit/Source/core/dom/TreeScope.cpp

 /*
  * Copyright (C) 2011 Google Inc. All Rights Reserved.
  * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 397 matching lines @@
 }
 
 void TreeScope::adoptIfNeeded(Node& node)
 {
     ASSERT(this);
     ASSERT(!node.isDocumentNode());
 #if !ENABLE(OILPAN)
     ASSERT_WITH_SECURITY_IMPLICATION(!node.m_deletionHasBegun);
 #endif
     TreeScopeAdopter adopter(node, *this);
-    if (adopter.needsScopeChange())
+    if (adopter.needsScopeChange()) {
+        ScriptForbiddenScope forbidScript;
         adopter.execute();
+    }
 }
 
 Element* TreeScope::adjustedFocusedElement() const
 {
     Document& document = rootNode().document();
     Element* element = document.focusedElement();
     if (!element && document.page())
         element = document.page()->focusController().focusedFrameOwnerElement(*document.frame());
     if (!element)
         return 0;
@@ skipping 144 matching lines @@
     visitor->trace(m_parentTreeScope);
     visitor->trace(m_idTargetObserverRegistry);
     visitor->trace(m_selection);
     visitor->trace(m_elementsById);
     visitor->trace(m_imageMapsByName);
     visitor->trace(m_labelsByForAttribute);
     visitor->trace(m_scopedStyleResolver);
 }
 
 } // namespace blink