2nd arg of document.createElement should be an object

third_party/WebKit/Source/bindings/core/v8/BUILD.gn

 # Copyright 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//testing/libfuzzer/fuzzer_test.gni")
 import("//third_party/WebKit/Source/bindings/bindings.gni")
 import("//third_party/WebKit/Source/bindings/scripts/scripts.gni")
 import("//third_party/WebKit/Source/core/core.gni")
 import("//third_party/WebKit/Source/core/core_idl_files.gni")
 
@@ skipping 13 matching lines @@
   "$blink_core_output_dir/css/MediaQueryListEventInit.cpp",
   "$blink_core_output_dir/css/MediaQueryListEventInit.h",
   "$blink_core_output_dir/css/PropertyDescriptor.cpp",
   "$blink_core_output_dir/css/PropertyDescriptor.h",
   "$blink_core_output_dir/css/cssom/CSSCalcDictionary.cpp",
   "$blink_core_output_dir/css/cssom/CSSCalcDictionary.h",
   "$blink_core_output_dir/dom/DOMPointInit.cpp",
   "$blink_core_output_dir/dom/DOMPointInit.h",
   "$blink_core_output_dir/dom/DOMMatrixInit.cpp",
   "$blink_core_output_dir/dom/DOMMatrixInit.h",
+  "$blink_core_output_dir/dom/ElementCreationOptions.cpp",
+  "$blink_core_output_dir/dom/ElementCreationOptions.h",
   "$blink_core_output_dir/dom/ElementDefinitionOptions.cpp",
   "$blink_core_output_dir/dom/ElementDefinitionOptions.h",
   "$blink_core_output_dir/dom/ElementRegistrationOptions.cpp",
   "$blink_core_output_dir/dom/ElementRegistrationOptions.h",
   "$blink_core_output_dir/dom/GetRootNodeOptions.cpp",
   "$blink_core_output_dir/dom/GetRootNodeOptions.h",
   "$blink_core_output_dir/dom/IdleRequestOptions.cpp",
   "$blink_core_output_dir/dom/IdleRequestOptions.h",
   "$blink_core_output_dir/dom/IntersectionObserverInit.cpp",
   "$blink_core_output_dir/dom/IntersectionObserverInit.h",
@@ skipping 129 matching lines @@
   "$bindings_core_v8_output_dir/NodeOrString.cpp",
   "$bindings_core_v8_output_dir/NodeOrString.h",
   "$bindings_core_v8_output_dir/RadioNodeListOrElement.cpp",
   "$bindings_core_v8_output_dir/RadioNodeListOrElement.h",
   "$bindings_core_v8_output_dir/StringOrArrayBuffer.cpp",
   "$bindings_core_v8_output_dir/StringOrArrayBuffer.h",
   "$bindings_core_v8_output_dir/StringOrArrayBufferOrArrayBufferView.cpp",
   "$bindings_core_v8_output_dir/StringOrArrayBufferOrArrayBufferView.h",
   "$bindings_core_v8_output_dir/StringOrCSSVariableReferenceValue.cpp",
   "$bindings_core_v8_output_dir/StringOrCSSVariableReferenceValue.h",
+  "$bindings_core_v8_output_dir/StringOrDictionary.cpp",
+  "$bindings_core_v8_output_dir/StringOrDictionary.h",
   "$bindings_core_v8_output_dir/StringOrFloat.cpp",
   "$bindings_core_v8_output_dir/StringOrFloat.h",
   "$bindings_core_v8_output_dir/USVStringOrURLSearchParams.cpp",
   "$bindings_core_v8_output_dir/USVStringOrURLSearchParams.h",
   "$bindings_core_v8_output_dir/UnrestrictedDoubleOrString.cpp",
   "$bindings_core_v8_output_dir/UnrestrictedDoubleOrString.h",
   "$bindings_core_v8_output_dir/VideoTrackOrAudioTrackOrTextTrack.cpp",
   "$bindings_core_v8_output_dir/VideoTrackOrAudioTrackOrTextTrack.h",
 ]
 
@@ skipping 115 matching lines @@
 fuzzer_test("v8_serialized_script_value_fuzzer") {
   sources = [
     "serialization/SerializedScriptValueFuzzer.cpp",
   ]
   seed_corpus = "serialization/fuzz_corpus"
   deps = [
     "//third_party/WebKit/Source/core",
     "//third_party/WebKit/Source/platform:blink_fuzzer_test_support",
   ]
 }