<webview>: Ensure that createGuest is only called after element attached to DOM

chrome/renderer/resources/extensions/web_view.js

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This module implements Webview (<webview>) as a custom element that wraps a
 // BrowserPlugin object element. The object element is hidden within
 // the shadow DOM of the Webview element.
 
 var DocumentNatives = requireNative('document_natives');
 var GuestViewInternal =
@@ skipping 70 matching lines @@
 // Implemented when the experimental API is available.
 WebViewInternal.maybeRegisterExperimentalAPIs = function(proto) {}
 
 /**
  * @constructor
  */
 function WebViewInternal(webviewNode) {
   privates(webviewNode).internal = this;
   this.webviewNode = webviewNode;
   this.attached = false;
+  this.elementAttached = false;
 
   this.beforeFirstNavigation = true;
   this.validPartitionId = true;
   // Used to save some state upon deferred attachment.
   // If <object> bindings is not available, we defer attachment.
   // This state contains whether or not the attachment request was for
   // newwindow.
   this.deferredAttachState = null;
 
   // on* Event handlers.
@@ skipping 518 matching lines @@
   if (!this.partition.validPartitionId) {
     result.error = ERROR_MSG_INVALID_PARTITION_ATTRIBUTE;
     return false;
   }
   this.src = this.webviewNode.getAttribute('src');
 
   if (!this.src) {
     return true;
   }
 
+  if (!this.elementAttached) {
+    return true;
+  }
+
   if (!this.hasGuestInstanceID()) {
     if (this.beforeFirstNavigation) {
       this.beforeFirstNavigation = false;
       this.allocateInstanceId();
     }
     return true;
   }
 
   // Navigate to this.src.
   WebView.navigate(this.instanceId, this.src);
@@ skipping 207 matching lines @@
 }
 
 // Registers <webview> custom element.
 function registerWebViewElement() {
   var proto = Object.create(HTMLElement.prototype);
 
   proto.createdCallback = function() {
     new WebViewInternal(this);
   };
 
-  proto.customElementDetached = false;
-
   proto.attributeChangedCallback = function(name, oldValue, newValue) {
     var internal = privates(this).internal;
     if (!internal) {
       return;
     }
     internal.handleWebviewAttributeMutation(name, oldValue, newValue);
   };
 
   proto.detachedCallback = function() {
-    this.customElementDetached = true;
+    var internal = privates(this).internal;
+    if (!internal) {
+      return;
+    }
+    internal.elementAttached = false;
   };
 
   proto.attachedCallback = function() {
-    if (this.customElementDetached) {
-      var webViewInternal = privates(this).internal;
-      webViewInternal.resetUponReattachment();
-      webViewInternal.allocateInstanceId();
+    var internal = privates(this).internal;
+    if (!internal) {
+      return;
     }
-    this.customElementDetached = false;
+    if (!internal.elementAttached) {
+      internal.elementAttached = true;
+      internal.resetUponReattachment();
+      internal.parseAttributes();
+    }
   };
 
   var methods = [
     'back',
     'find',
     'forward',
     'canGoBack',
     'canGoForward',
     'clearData',
     'getProcessId',
@@ skipping 75 matching lines @@
 };
 
 /**
  * Implemented when the experimental API is available.
  * @private
  */
 WebViewInternal.prototype.setupExperimentalContextMenus = function() {};
 
 exports.WebView = WebView;
 exports.WebViewInternal = WebViewInternal;