Fix detached event listener attribute updating.

third_party/WebKit/Source/core/events/EventTarget.cpp

Index: third_party/WebKit/Source/core/events/EventTarget.cpp
diff --git a/third_party/WebKit/Source/core/events/EventTarget.cpp b/third_party/WebKit/Source/core/events/EventTarget.cpp
index c3d395b70091abac31014faee6c00a895e1481b3..97d112492da1a432c0c20e96f7ef7dc5bb20ba4c 100644
--- a/third_party/WebKit/Source/core/events/EventTarget.cpp
+++ b/third_party/WebKit/Source/core/events/EventTarget.cpp
@@ -427,10 +427,14 @@ EventListener* EventTarget::GetAttributeEventListener(
   if (!listener_vector)
     return nullptr;
 
+  // The current-world accessibiliy check has a corner
+  // case which depends on knowing whether we're in
+  // a document parsing context or not.
+  Node* this_node = ToNode();
+  Document* document = this_node ? &this_node->GetDocument() : nullptr;
   for (auto& event_listener : *listener_vector) {
     EventListener* listener = event_listener.Listener();
-    if (listener->IsAttribute() &&
-        listener->BelongsToTheCurrentWorld(GetExecutionContext()))
+    if (listener->IsAttribute() && listener->BelongsToTheCurrentWorld(document))
       return listener;
   }
   return nullptr;