Do not push the custom element construction stack in some cases.

third_party/WebKit/Source/bindings/core/v8/ScriptCustomElementDefinition.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "bindings/core/v8/ScriptCustomElementDefinition.h"
 
 #include "bindings/core/v8/ScriptState.h"
 #include "bindings/core/v8/V8Binding.h"
 #include "bindings/core/v8/V8BindingMacros.h"
 #include "bindings/core/v8/V8CustomElementRegistry.h"
 #include "bindings/core/v8/V8Element.h"
 #include "bindings/core/v8/V8ErrorHandler.h"
 #include "bindings/core/v8/V8HiddenValue.h"
 #include "bindings/core/v8/V8ScriptRunner.h"
 #include "bindings/core/v8/V8ThrowException.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/custom/CustomElement.h"
 #include "core/events/ErrorEvent.h"
 #include "core/html/HTMLElement.h"
+#include "core/html/imports/HTMLImportsController.h"
 #include "v8.h"
 #include "wtf/Allocator.h"
 
 namespace blink {
 
 // Retrieves the custom elements constructor -> name map, creating it
 // if necessary.
 static v8::Local<v8::Map> ensureCustomElementRegistryMap(
     ScriptState* scriptState,
     CustomElementRegistry* registry) {
@@ skipping 148 matching lines @@
     return CustomElement::createFailedElement(document, tagName);
   ScriptState::Scope scope(m_scriptState.get());
   v8::Isolate* isolate = m_scriptState->isolate();
 
   ExceptionState exceptionState(isolate, ExceptionState::ConstructionContext,
                                 "CustomElement");
 
   // Create an element with the synchronous custom elements flag set.
   // https://dom.spec.whatwg.org/#concept-create-element
 
-  // Create an element and push to the construction stack.
-  // V8HTMLElement::constructorCustom() can only refer to
-  // window.document(), but it is different from the document here
-  // when it is an import document. This is not exactly what the
-  // spec defines, but the non-imports behavior matches to the spec.
-  Element* element = createElementForConstructor(document);
+  // TODO(dominicc): Implement step 5 which constructs customized
+  // built-in elements.
+
+  Element* element = nullptr;
   {
-    ConstructionStackScope constructionStackScope(this, element);
     v8::TryCatch tryCatch(m_scriptState->isolate());
-    element = runConstructor();
+
+    bool isImportDocument = document.importsController() &&
+                            document.importsController()->master() != document;
+    if (isImportDocument) {
+      // V8HTMLElement::constructorCustom() can only refer to
+      // window.document() which is not the import document. Create
+      // elements in import documents ahead of time so they end up in
+      // the right document. This subtly violates recursive
+      // construction semantics, but only in import documents.
+      element = createElementForConstructor(document);
+      DCHECK(!tryCatch.HasCaught());
+
+      ConstructionStackScope constructionStackScope(this, element);
+      element = callConstructor();
+    } else {
+      element = callConstructor();
+    }
+
     if (tryCatch.HasCaught()) {
       exceptionState.rethrowV8Exception(tryCatch.Exception());
       return handleCreateElementSyncException(document, tagName, isolate,
                                               exceptionState);
     }
   }
 
   // 6.1.3. through 6.1.9.
   checkConstructorResult(element, document, tagName, exceptionState);
   if (exceptionState.hadException()) {
     return handleCreateElementSyncException(document, tagName, isolate,
                                             exceptionState);
   }
   DCHECK_EQ(element->getCustomElementState(), CustomElementState::Custom);
   return toHTMLElement(element);
 }
 
 // https://html.spec.whatwg.org/multipage/scripting.html#upgrades
 bool ScriptCustomElementDefinition::runConstructor(Element* element) {
   if (!m_scriptState->contextIsValid())
     return false;
   ScriptState::Scope scope(m_scriptState.get());
   v8::Isolate* isolate = m_scriptState->isolate();
 
   // Step 5 says to rethrow the exception; but there is no one to
   // catch it. The side effect is to report the error.
   v8::TryCatch tryCatch(isolate);
   tryCatch.SetVerbose(true);
 
-  Element* result = runConstructor();
+  Element* result = callConstructor();
 
-  // To report exception thrown from runConstructor()
+  // To report exception thrown from callConstructor()
   if (tryCatch.HasCaught())
     return false;
 
   // To report InvalidStateError Exception, when the constructor returns some
   // different object
   if (result != element) {
     const String& message =
         "custom element constructors must call super() first and must "
         "not return a different object";
     v8::Local<v8::Value> exception = V8ThrowException::createDOMException(
         m_scriptState->isolate(), InvalidStateError, message);
     dispatchErrorEvent(isolate, exception, constructor());
     return false;
   }
 
   return true;
 }
 
-Element* ScriptCustomElementDefinition::runConstructor() {
+Element* ScriptCustomElementDefinition::callConstructor() {
   v8::Isolate* isolate = m_scriptState->isolate();
   DCHECK(ScriptState::current(isolate) == m_scriptState);
   ExecutionContext* executionContext = m_scriptState->getExecutionContext();
   v8::Local<v8::Value> result;
   if (!v8Call(V8ScriptRunner::callAsConstructor(isolate, constructor(),
                                                 executionContext, 0, nullptr),
               result)) {
     return nullptr;
   }
   return V8Element::toImplWithTypeCheck(isolate, result);
@@ skipping 84 matching lines @@
   v8::Local<v8::Value> argv[] = {
       v8String(isolate, name.localName()), v8StringOrNull(isolate, oldValue),
       v8StringOrNull(isolate, newValue),
       v8StringOrNull(isolate, name.namespaceURI()),
   };
   runCallback(m_attributeChangedCallback.newLocal(isolate), element,
               WTF_ARRAY_LENGTH(argv), argv);
 }
 
 }  // namespace blink