SELECT popup: Fix a crash by DOM mutation during opening popup.

third_party/WebKit/Source/core/html/HTMLSelectElement.cpp

 /*
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
@@ skipping 1997 matching lines @@
     DECLARE_VIRTUAL_TRACE();
 
     void dispose()
     {
         m_observer->disconnect();
     }
 
 private:
     void call(const HeapVector<Member<MutationRecord>>&, MutationObserver*) override
     {
+        // We disconnect the MutationObserver when a popuup is closed.  However
+        // MutationObserver can call back after disconnection.
+        if (!m_select->popupIsVisible())
+            return;
         m_select->didMutateSubtree();
     }
 
     ExecutionContext* getExecutionContext() const override
     {
         return &m_select->document();
     }
 
     Member<HTMLSelectElement> m_select;
     Member<MutationObserver> m_observer;
@@ skipping 41 matching lines @@
 }
 
 void HTMLSelectElement::didMutateSubtree()
 {
     DCHECK(popupIsVisible());
     DCHECK(m_popup);
     m_popup->updateFromElement(PopupMenu::ByDOMChange);
 }
 
 } // namespace blink