Merge "SELECT popup: Fix a crash by DOM mutation during opening popup." to M52 branch.

third_party/WebKit/Source/core/html/HTMLSelectElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp b/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
index 6da2ad4dd50b7bf62fd848db141cf31a8c3d86fd..67bb08c09354bb63a024dfadcdcd636f2ca27cb7 100644
--- a/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
@@ -2017,6 +2017,10 @@ public:
 private:
     void call(const HeapVector<Member<MutationRecord>>&, MutationObserver*) override
     {
+        // We disconnect the MutationObserver when a popuup is closed.  However
+        // MutationObserver can call back after disconnection.
+        if (!m_select->popupIsVisible())
+            return;
         m_select->didMutateSubtree();
     }