Merge 192655 "MutationObserver: add a check that iterating regis..."

Source/core/dom/MutationObserver.cpp

Index: Source/core/dom/MutationObserver.cpp
===================================================================
--- Source/core/dom/MutationObserver.cpp	(revision 193430)
+++ Source/core/dom/MutationObserver.cpp	(working copy)
@@ -156,8 +156,12 @@
     m_records.clear();
     InspectorInstrumentation::didClearAllMutationRecords(m_callback->executionContext(), this);
     MutationObserverRegistrationSet registrations(m_registrations);
-    for (auto& registration : registrations)
-        registration->unregister();
+    for (auto& registration : registrations) {
+        // The registration may be already unregistered while iteration.
+        // Only call unregister if it is still in the original set.
+        if (m_registrations.contains(registration))
+            registration->unregister();
+    }
     ASSERT(m_registrations.isEmpty());
 }