MutationObserver: add a check that iterating registration still exists in original set

Source/core/dom/MutationObserver.cpp

Index: Source/core/dom/MutationObserver.cpp
diff --git a/Source/core/dom/MutationObserver.cpp b/Source/core/dom/MutationObserver.cpp
index 46905e3e15366b3b0507b493c7c416f052d30ba2..b90f533d01cdc4f83d053fc6c3b25d1af35500a4 100644
--- a/Source/core/dom/MutationObserver.cpp
+++ b/Source/core/dom/MutationObserver.cpp
@@ -156,8 +156,12 @@ void MutationObserver::disconnect()
     m_records.clear();
     InspectorInstrumentation::didClearAllMutationRecords(m_callback->executionContext(), this);
     MutationObserverRegistrationSet registrations(m_registrations);
-    for (auto& registration : registrations)
-        registration->unregister();
+    for (auto& registration : registrations) {
+        // The registration may be already unregistered while iteration.
+        // Only call unregister if it is still in the original set.
+        if (m_registrations.contains(registration))
+            registration->unregister();
+    }
     ASSERT(m_registrations.isEmpty());
 }