MutationObserver: add a check that iterating registration still exists in original set

MutationObserver: add a check that iterating registration still exists in original set

The MutationObserver registration may be unregistered from the original set
while iterating on the cloned set.
Add a check so that it would only call unregister() on active registrations.

BUG=453279
TEST=manually tested from fuzzer repro case :(

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=192655

[kouhei (in TOK), 2015-03-27 02:30:57]

kouhei@chromium.org changed reviewers:
+ adamk@chromium.org, haraken@chromium.org

[kouhei (in TOK), 2015-03-27 02:30:58]

PTAL

[haraken, 2015-03-27 02:40:10]

Thanks for the quick fix!

Can we add a test?

https://codereview.chromium.org/1039523003/diff/1/Source/core/dom/MutationObs...
File Source/core/dom/MutationObserver.cpp (right):

https://codereview.chromium.org/1039523003/diff/1/Source/core/dom/MutationObs...
Source/core/dom/MutationObserver.cpp:160: if
(m_registrations.contains(registration))

Would you add a comment on this (i.e., the registration object might have
already been removed from the list when we unregistered another object)?

[kouhei (in TOK), 2015-03-27 03:34:12]

On 2015/03/27 02:40:10, haraken wrote:
> Thanks for the quick fix!
> 
> Can we add a test?
Discussed offline.
I tried, but couldn't create a non-flaky test case for this. It seems it really
depend on how the gc task is scheduled.

>
https://codereview.chromium.org/1039523003/diff/1/Source/core/dom/MutationObs...
> File Source/core/dom/MutationObserver.cpp (right):
> 
>
https://codereview.chromium.org/1039523003/diff/1/Source/core/dom/MutationObs...
> Source/core/dom/MutationObserver.cpp:160: if
> (m_registrations.contains(registration))
> 
> Would you add a comment on this (i.e., the registration object might have
> already been removed from the list when we unregistered another object)?
Done.

[haraken, 2015-03-27 03:40:36]

LGTM

[kouhei (in TOK), 2015-03-27 03:43:34]

The CQ bit was checked by kouhei@chromium.org

[commit-bot: I haz the power, 2015-03-27 03:44:07]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1039523003/20001

[commit-bot: I haz the power, 2015-03-27 07:16:47]

Committed patchset #2 (id:20001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=192655