The HTML parser synchronously creates custom elements

third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp

Index: third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp
diff --git a/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp b/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp
index ff36b586a035cec8d33d12914b22a5cf36811420..55d203c8e2162a23f3322c6447f40e6eafcc6187 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp
+++ b/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp
@@ -267,7 +267,7 @@ HTMLTreeBuilder::HTMLTreeBuilder(HTMLDocumentParser* parser, Document& document,
 #if ENABLE(ASSERT)
     , m_isAttached(true)
 #endif
-    , m_tree(document, parserContentPolicy)
+    , m_tree(parser->reentryPermit(), document, parserContentPolicy)
     , m_insertionMode(InitialMode)
     , m_originalInsertionMode(InitialMode)
     , m_shouldSkipLeadingNewline(false)
@@ -326,8 +326,9 @@ DEFINE_TRACE(HTMLTreeBuilder)
 void HTMLTreeBuilder::detach()
 {
 #if ENABLE(ASSERT)
-    // This call makes little sense in fragment mode, but for consistency
-    // DocumentParser expects detach() to always be called before it's destroyed.
+    // This call makes little sense in fragment mode, but for
+    // consistency DocumentParser expects detach() to always be called
+    // before it's destroyed.
     m_isAttached = false;
 #endif
     // HTMLConstructionSite might be on the callstack when detach() is called