Copy Page::ordinaryPages() before undeferring loads.

third_party/WebKit/Source/core/page/ScopedPageLoadDeferrer.cpp

Index: third_party/WebKit/Source/core/page/ScopedPageLoadDeferrer.cpp
diff --git a/third_party/WebKit/Source/core/page/ScopedPageLoadDeferrer.cpp b/third_party/WebKit/Source/core/page/ScopedPageLoadDeferrer.cpp
index be85168aa42537058c73dbf285db5754b4cd3d53..bedf6765e1a1a15cde093789c0e290078ce79a03 100644
--- a/third_party/WebKit/Source/core/page/ScopedPageLoadDeferrer.cpp
+++ b/third_party/WebKit/Source/core/page/ScopedPageLoadDeferrer.cpp
@@ -37,7 +37,12 @@ unsigned s_deferralCount = 0;
 
 void setDefersLoading(bool isDeferred)
 {
+    // Make a copy of the collection. Undeferring loads can cause script to run,
+    // which would mutate ordinaryPages() in the middle of iteration.
+    HeapVector<Member<Page>> pages;
     for (const auto& page : Page::ordinaryPages())
+        pages.append(page);

[esprehn, 2016/08/16 02:31:42]

copyToVector(pages, Page::ordinaryPages())

+    for (const auto& page : pages)
         page->setDefersLoading(isDeferred);
 }