Revert unintentional switching to element document in an AllowedByNosniff call

In classic_pending_script.cc, [1] uses
GetElement()->GetDocument().Fetcher()->Context()
which corresponds to the element document, while before [1] it was
GetElement()->GetDocument().ContextDocument()
which corresponds to the context document.

This CL reverts this change and uses the context document, and
adds a regression test derived from a clusterfuzz test case.

[1] https://chromium-review.googlesource.com/1351873

Bug: 912046, 880027
Change-Id: I92ca9723c3fdd1c5d9c304e4e196aeb77c75ee88
Reviewed-on: https://chromium-review.googlesource.com/c/1364050
Reviewed-by: Hiroki Nakagawa <nhiroki@chromium.org>
Commit-Queue: Hiroshige Hayashizaki <hiroshige@chromium.org>
Cr-Commit-Position: refs/heads/master@{#614279}
2 files changed