Fix crash when removing contents from a document having multiple bodies

third_party/WebKit/Source/platform/graphics/paint/DisplayItemClient.cpp

Index: third_party/WebKit/Source/platform/graphics/paint/DisplayItemClient.cpp
diff --git a/third_party/WebKit/Source/platform/graphics/paint/DisplayItemClient.cpp b/third_party/WebKit/Source/platform/graphics/paint/DisplayItemClient.cpp
index c2449e5b53dd93a931e797ede7b0fee770410fc4..b2cd4f7d68ca263d317c7ab125aa5a768d42ce53 100644
--- a/third_party/WebKit/Source/platform/graphics/paint/DisplayItemClient.cpp
+++ b/third_party/WebKit/Source/platform/graphics/paint/DisplayItemClient.cpp
@@ -35,7 +35,7 @@ DisplayItemClient::~DisplayItemClient()
         for (auto& item : *displayItemClientsShouldKeepAlive) {
             CHECK(!item.value.contains(this))
                 << "Short-lived DisplayItemClient: " << item.value.get(this)
-                << ". See crbug.com/570030.";
+                << ". See crbug.com/609218.";
         }
     }
     liveDisplayItemClients->remove(this);
@@ -61,7 +61,7 @@ void DisplayItemClient::beginShouldKeepAlive(const void* owner) const
 void DisplayItemClient::endShouldKeepAlive() const
 {
     if (displayItemClientsShouldKeepAlive) {
-        for (auto item : *displayItemClientsShouldKeepAlive)
+        for (auto& item : *displayItemClientsShouldKeepAlive)
             item.value.remove(this);
     }
 }