MutationObserver: add a check that iterating registration still exists in original set

Source/core/dom/MutationObserver.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 138 matching lines @@
     records.swap(m_records);
     InspectorInstrumentation::didClearAllMutationRecords(m_callback->executionContext(), this);
     return records;
 }
 
 void MutationObserver::disconnect()
 {
     m_records.clear();
     InspectorInstrumentation::didClearAllMutationRecords(m_callback->executionContext(), this);
     MutationObserverRegistrationSet registrations(m_registrations);
-    for (auto& registration : registrations)
-        registration->unregister();
+    for (auto& registration : registrations) {
+        // The registration may be already unregistered while iteration.
+        // Only call unregister if it is still in the original set.
+        if (m_registrations.contains(registration))
+            registration->unregister();
+    }
     ASSERT(m_registrations.isEmpty());
 }
 
 void MutationObserver::observationStarted(MutationObserverRegistration* registration)
 {
     ASSERT(!m_registrations.contains(registration));
     m_registrations.add(registration);
 }
 
 void MutationObserver::observationEnded(MutationObserverRegistration* registration)
@@ skipping 109 matching lines @@
 {
 #if ENABLE(OILPAN)
     visitor->trace(m_callback);
     visitor->trace(m_records);
     visitor->trace(m_registrations);
     visitor->trace(m_callback);
 #endif
 }
 
 } // namespace blink