Fix ScriptCustomElementDefinition::createElementSync to use the given document

third_party/WebKit/Source/bindings/core/v8/ScriptCustomElementDefinition.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "bindings/core/v8/ScriptCustomElementDefinition.h"
 
 #include "bindings/core/v8/ScriptState.h"
 #include "bindings/core/v8/V8Binding.h"
 #include "bindings/core/v8/V8BindingMacros.h"
 #include "bindings/core/v8/V8CustomElementRegistry.h"
@@ skipping 152 matching lines @@
     Document& document, const QualifiedName& tagName,
     ExceptionState& exceptionState)
 {
     DCHECK(ScriptState::current(m_scriptState->isolate()) == m_scriptState);
 
     // Create an element
     // https://dom.spec.whatwg.org/#concept-create-element
     // 6. If definition is non-null
     // 6.1. If the synchronous custom elements flag is set:
     // 6.1.2. Set result to Construct(C). Rethrow any exceptions.
-    Element* element = nullptr;
+
+    // Create an element and push to the construction stack.
+    // V8HTMLElement::constructorCustom() can only refer to
+    // window.document(), but it is different from the document here
+    // when it is an import document.  This is not exactly what the
+    // spec defines, but the public behavior matches to the spec.
+    Element* element = createElementForConstructor(document);
     {
+        ConstructionStackScope constructionStackScope(this, element);
         v8::TryCatch tryCatch(m_scriptState->isolate());
         element = runConstructor();
         if (tryCatch.HasCaught()) {
             exceptionState.rethrowV8Exception(tryCatch.Exception());
             return nullptr;
         }
     }
 
     // 6.1.3. through 6.1.9.
     checkConstructorResult(element, document, tagName, exceptionState);
@@ skipping 186 matching lines @@
         v8String(isolate, name.localName()),
         v8StringOrNull(isolate, oldValue),
         v8StringOrNull(isolate, newValue),
         v8String(isolate, name.namespaceURI()),
     };
     runCallback(m_attributeChangedCallback.newLocal(isolate), element,
         argc, argv);
 }
 
 } // namespace blink