MutationObserver: add a check that iterating registration still exists in original set

Source/core/dom/MutationObserver.cpp

Index: Source/core/dom/MutationObserver.cpp
diff --git a/Source/core/dom/MutationObserver.cpp b/Source/core/dom/MutationObserver.cpp
index 46905e3e15366b3b0507b493c7c416f052d30ba2..54c72e91057939bbdf0d1beed339531cd93cb71d 100644
--- a/Source/core/dom/MutationObserver.cpp
+++ b/Source/core/dom/MutationObserver.cpp
@@ -156,8 +156,10 @@ void MutationObserver::disconnect()
     m_records.clear();
     InspectorInstrumentation::didClearAllMutationRecords(m_callback->executionContext(), this);
     MutationObserverRegistrationSet registrations(m_registrations);
-    for (auto& registration : registrations)
-        registration->unregister();
+    for (auto& registration : registrations) {
+        if (m_registrations.contains(registration))

[haraken, 2015/03/27 02:40:10]

Would you add a comment on this (i.e., the registration object might have
already been removed from the list when we unregistered another object)?

+            registration->unregister();
+    }
     ASSERT(m_registrations.isEmpty());
 }