Fix detached event listener attribute updating.

third_party/WebKit/Source/core/events/EventTarget.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  *           (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ skipping 409 matching lines @@
     return false;
   return addEventListener(event_type, listener, false);
 }
 
 EventListener* EventTarget::GetAttributeEventListener(
     const AtomicString& event_type) {
   EventListenerVector* listener_vector = GetEventListeners(event_type);
   if (!listener_vector)
     return nullptr;
 
+  // The current-world accessibiliy check has a corner
+  // case which depends on knowing whether we're in
+  // a document parsing context or not.
+  Node* this_node = ToNode();
+  Document* document = this_node ? &this_node->GetDocument() : nullptr;
   for (auto& event_listener : *listener_vector) {
     EventListener* listener = event_listener.Listener();
-    if (listener->IsAttribute() &&
-        listener->BelongsToTheCurrentWorld(GetExecutionContext()))
+    if (listener->IsAttribute() && listener->BelongsToTheCurrentWorld(document))
       return listener;
   }
   return nullptr;
 }
 
 bool EventTarget::ClearAttributeEventListener(const AtomicString& event_type) {
   EventListener* listener = GetAttributeEventListener(event_type);
   if (!listener)
     return false;
   return removeEventListener(event_type, listener, false);
@@ skipping 331 matching lines @@
   // they have one less listener to invoke.
   if (d->firing_event_iterators) {
     for (const auto& iterator : *d->firing_event_iterators) {
       iterator.iterator = 0;
       iterator.end = 0;
     }
   }
 }
 
 }  // namespace blink