MutationObserver: Fix a null-pointer dereference in MutationObserverRegistration::unregister.

third_party/WebKit/Source/core/dom/MutationObserverRegistration.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 89 matching lines @@
     node->unregisterTransientMutationObserver(this);
 
   m_transientRegistrationNodes.clear();
 
   DCHECK(m_registrationNodeKeepAlive);
   m_registrationNodeKeepAlive =
       nullptr;  // Balanced in observeSubtreeNodeWillDetach.
 }
 
 void MutationObserverRegistration::unregister() {
-  DCHECK(m_registrationNode);
-  m_registrationNode->unregisterMutationObserver(this);
-  // The above line will cause this object to be deleted, so don't do any more
-  // in this function.
+  // |this| can outlives m_registrationNode.
+  if (m_registrationNode)
+    m_registrationNode->unregisterMutationObserver(this);
+  else
+    dispose();
 }
 
 bool MutationObserverRegistration::shouldReceiveMutationFrom(
     Node& node,
     MutationObserver::MutationType type,
     const QualifiedName* attributeName) const {
   DCHECK((type == MutationObserver::Attributes && attributeName) ||
          !attributeName);
   if (!(m_options & type))
     return false;
@@ skipping 27 matching lines @@
   visitor->trace(m_registrationNode);
   visitor->trace(m_registrationNodeKeepAlive);
   visitor->trace(m_transientRegistrationNodes);
 }
 
 DEFINE_TRACE_WRAPPERS(MutationObserverRegistration) {
   visitor->traceWrappers(m_observer);
 }
 
 }  // namespace blink