MutationObserver: Fix a null-pointer dereference in MutationObserverRegistration::unregister.

third_party/WebKit/Source/core/dom/MutationObserver.h

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 13 matching lines @@
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef MutationObserver_h
 #define MutationObserver_h
 
+#include "base/gtest_prod_util.h"
 #include "bindings/core/v8/ScriptWrappable.h"
+#include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
 #include "wtf/HashSet.h"
 #include "wtf/Vector.h"
 
 namespace blink {
 
 class ExceptionState;
 class MutationCallback;
 class MutationObserver;
 class MutationObserverInit;
 class MutationObserverRegistration;
 class MutationRecord;
 class Node;
 
 typedef unsigned char MutationObserverOptions;
 typedef unsigned char MutationRecordDeliveryOptions;
 
 using MutationObserverSet = HeapHashSet<Member<MutationObserver>>;
 using MutationObserverRegistrationSet =
     HeapHashSet<WeakMember<MutationObserverRegistration>>;
 using MutationObserverVector = HeapVector<Member<MutationObserver>>;
 using MutationRecordVector = HeapVector<Member<MutationRecord>>;
 
-class MutationObserver final
+class CORE_EXPORT MutationObserver final
     : public GarbageCollectedFinalized<MutationObserver>,
       public ScriptWrappable {
   DEFINE_WRAPPERTYPEINFO();
 
  public:
   enum MutationType {
     ChildList = 1 << 0,
     Attributes = 1 << 1,
     CharacterData = 1 << 2,
 
@@ skipping 32 matching lines @@
 
   explicit MutationObserver(MutationCallback*);
   void deliver();
   bool shouldBeSuspended() const;
   void cancelInspectorAsyncTasks();
 
   Member<MutationCallback> m_callback;
   MutationRecordVector m_records;
   MutationObserverRegistrationSet m_registrations;
   unsigned m_priority;
+
+  FRIEND_TEST_ALL_PREFIXES(MutationObserverTest, DisconnectCrash);
 };
 
 }  // namespace blink
 
 #endif  // MutationObserver_h