Recursively defining custom elements should not lead to redefinition

third_party/WebKit/Source/core/dom/custom/CustomElementsRegistry.cpp

Index: third_party/WebKit/Source/core/dom/custom/CustomElementsRegistry.cpp
diff --git a/third_party/WebKit/Source/core/dom/custom/CustomElementsRegistry.cpp b/third_party/WebKit/Source/core/dom/custom/CustomElementsRegistry.cpp
index 618fa6158733ce98c0e8a201fb189d03966b939a..9bfcaf6cc134a92d30878b1fbac5c2003b20889b 100644
--- a/third_party/WebKit/Source/core/dom/custom/CustomElementsRegistry.cpp
+++ b/third_party/WebKit/Source/core/dom/custom/CustomElementsRegistry.cpp
@@ -13,9 +13,34 @@
 #include "core/dom/custom/CustomElementDefinition.h"
 #include "core/dom/custom/CustomElementDefinitionBuilder.h"
 #include "core/dom/custom/V0CustomElementRegistrationContext.h"
+#include "wtf/Allocator.h"
 
 namespace blink {
 
+class CustomElementsRegistry::NameIsBeingDefined final {
+    STACK_ALLOCATED();
+    DISALLOW_IMPLICIT_CONSTRUCTORS(NameIsBeingDefined);
+public:
+    NameIsBeingDefined(
+        CustomElementsRegistry* registry,
+        const AtomicString& name)
+        : m_registry(registry)
+        , m_name(name)
+    {
+        DCHECK(!m_registry->m_namesBeingDefined.contains(name));
+        m_registry->m_namesBeingDefined.add(name);
+    }
+
+    ~NameIsBeingDefined()
+    {
+        m_registry->m_namesBeingDefined.remove(m_name);
+    }
+
+private:
+    Member<CustomElementsRegistry> m_registry;
+    const AtomicString& m_name;
+};
+
 CustomElementsRegistry* CustomElementsRegistry::create(
     V0CustomElementRegistrationContext* v0)
 {
@@ -71,6 +96,14 @@ void CustomElementsRegistry::define(
         return;
     }
 
+    if (m_namesBeingDefined.contains(name)) {
+        exceptionState.throwDOMException(
+            NotSupportedError,
+            "this name is already being defined in this registry");
+        return;
+    }
+    NameIsBeingDefined defining(this, name);
+
     if (nameIsDefined(name) || v0NameIsDefined(name)) {
         exceptionState.throwDOMException(
             NotSupportedError,