Give attribute-change callbacks a realm so they can to_jsval

components/script/dom/customelementregistry.rs

@@ -897,6 +897,10 @@ impl CustomElementReactionStack {
                 }
 
                 let cx = element.global().get_cx();
+                // We might be here during HTML parsing, rather than
+                // during Javscript execution, and so we typically aren't
+                // already in a realm here.
+                let _ac = JSAutoRealm::new(*cx, element.global().reflector().get_jsobject().get());
 
                 let local_name = DOMString::from(&*local_name);
                 rooted!(in(*cx) let mut name_value = UndefinedValue());

tests/wpt/metadata/custom-elements/parser/parser-sets-attributes-and-children.html.ini

@@ -1,2 +1,4 @@
 [parser-sets-attributes-and-children.html]
-  expected: CRASH
+  [HTML parser should call connectedCallback before appending child nodes.]
+    expected: FAIL
+