Form-associated custom elements: Fix a crash with documents without browsing context.

CustomElement::Registry() can return nullptr.

Bug: 906704
Change-Id: I5f3f87266526c97489b658668e15a38069fef033
Reviewed-on: https://chromium-review.googlesource.com/c/1343412Reviewed-by: Hayato Ito <hayato@chromium.org>
Commit-Queue: Kent Tamura <tkent@chromium.org>
Cr-Commit-Position: refs/heads/master@{#609613}

third_party/WebKit/LayoutTests/custom-elements/tentative/HTMLElement-attachInternals.html

@@ -34,6 +34,11 @@ test(() => {
   const builtin = document.createElement('div');
   assert_throws('InvalidStateError', () => { builtin.attachInternals() });
 
+  const doc = document.implementation.createDocument('foo', null);
+  const span = doc.appendChild(doc.createElementNS('http://www.w3.org/1999/xhtml', 'html:span'));
+  assert_true(span instanceof HTMLElement);
+  assert_throws('InvalidStateError', () => { span.attachInternals(); });
+
   const undefinedCustom = document.createElement('my-element');
   assert_throws('InvalidStateError', () => { undefinedCustom.attachInternals() });
 }, 'If a custom element definition for the local name of the element doesn\'t' +

third_party/blink/renderer/core/html/html_element.cc

@@ -1413,8 +1413,9 @@ void HTMLElement::OnXMLLangAttrChanged(
 
 ElementInternals* HTMLElement::attachInternals(
     ExceptionState& exception_state) {
+  CustomElementRegistry* registry = CustomElement::Registry(*this);
   auto* definition =
-      CustomElement::Registry(*this)->DefinitionForName(localName());
+      registry ? registry->DefinitionForName(localName()) : nullptr;
   if (!definition) {
     exception_state.ThrowDOMException(
         DOMExceptionCode::kInvalidStateError,