Fix an edge case where early disconnect() can omit delivering of observation. crbug/607324

third_party/WebKit/Source/core/timing/PerformanceBase.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2012 Intel Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 334 matching lines @@
 }
 
 void PerformanceBase::registerPerformanceObserver(PerformanceObserver& observer)
 {
     m_observerFilterOptions |= observer.filterOptions();
     m_observers.add(&observer);
 }
 
 void PerformanceBase::unregisterPerformanceObserver(PerformanceObserver& oldObserver)
 {
+    ASSERT(isMainThread());
+    // Deliver any pending observations on this observer before unregistering.
+    if (m_activeObservers.contains(&oldObserver) && !oldObserver.shouldBeSuspended()) {
+        oldObserver.deliver();
+        m_activeObservers.remove(&oldObserver);
+    }
     m_observers.remove(&oldObserver);
     updatePerformanceObserverFilterOptions();
 }
 
 void PerformanceBase::updatePerformanceObserverFilterOptions()
 {
     m_observerFilterOptions = PerformanceEntry::Invalid;
     for (const auto& observer : m_observers) {
         m_observerFilterOptions |= observer->filterOptions();
     }
@@ skipping 77 matching lines @@
     visitor->trace(m_frameTimingBuffer);
     visitor->trace(m_resourceTimingBuffer);
     visitor->trace(m_userTiming);
     visitor->trace(m_observers);
     visitor->trace(m_activeObservers);
     visitor->trace(m_suspendedObservers);
     EventTargetWithInlineData::trace(visitor);
 }
 
 } // namespace blink