Crash in blink::beforeCallEnteredCallback()

third_party/WebKit/Source/core/html/HTMLMediaElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp b/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
index 363bea977d7787a7995c790328f8cfa42d7b00af..589e7c2e5f4eeb6d6816d1d21fdcf2321ff14616 100644
--- a/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
@@ -829,9 +829,11 @@ void HTMLMediaElement::invokeLoadAlgorithm() {
 
       // 4.6.2 - Take pending play promises and reject pending play promises
       // with the result and an "AbortError" DOMException.
-      rejectPlayPromises(
-          AbortError,
-          "The play() request was interrupted by a new load request.");
+      if (!ScriptForbiddenScope::isScriptForbidden()) {
+        rejectPlayPromises(
+            AbortError,
+            "The play() request was interrupted by a new load request.");
+      }
     }
 
     // 4.7 - If seeking is true, set it to false.