Crash in blink::beforeCallEnteredCallback()

third_party/WebKit/Source/core/html/HTMLMediaElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp b/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
index 791640db9e8986b96e9bacb545a22b4b5128b2c3..704e66b67cf213edb57a53637eece13cd67dc9a1 100644
--- a/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
@@ -829,9 +829,11 @@ void HTMLMediaElement::invokeLoadAlgorithm() {
 
       // 4.6.2 - Take pending play promises and reject pending play promises
       // with the result and an "AbortError" DOMException.
-      rejectPlayPromises(
-          AbortError,
-          "The play() request was interrupted by a new load request.");
+      if (!ScriptForbiddenScope::isScriptForbidden()) {
+        rejectPlayPromises(
+            AbortError,
+            "The play() request was interrupted by a new load request.");
+      }
     }
 
     // 4.7 - If seeking is true, set it to false.