MutationObserver: Fix a null-pointer dereference in MutationObserverRegistration::unregister.

third_party/WebKit/Source/core/dom/MutationObserver.h

Index: third_party/WebKit/Source/core/dom/MutationObserver.h
diff --git a/third_party/WebKit/Source/core/dom/MutationObserver.h b/third_party/WebKit/Source/core/dom/MutationObserver.h
index 435bb9bea015242ac5cd29f6fb0786d5bd7dc257..6b35d7312eb4cd89833b85ed2231b91c3dee1c95 100644
--- a/third_party/WebKit/Source/core/dom/MutationObserver.h
+++ b/third_party/WebKit/Source/core/dom/MutationObserver.h
@@ -31,7 +31,9 @@
 #ifndef MutationObserver_h
 #define MutationObserver_h
 
+#include "base/gtest_prod_util.h"
 #include "bindings/core/v8/ScriptWrappable.h"
+#include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
 #include "wtf/HashSet.h"
 #include "wtf/Vector.h"
@@ -55,7 +57,7 @@ using MutationObserverRegistrationSet =
 using MutationObserverVector = HeapVector<Member<MutationObserver>>;
 using MutationRecordVector = HeapVector<Member<MutationRecord>>;
 
-class MutationObserver final
+class CORE_EXPORT MutationObserver final
     : public GarbageCollectedFinalized<MutationObserver>,
       public ScriptWrappable {
   DEFINE_WRAPPERTYPEINFO();
@@ -108,6 +110,8 @@ class MutationObserver final
   MutationRecordVector m_records;
   MutationObserverRegistrationSet m_registrations;
   unsigned m_priority;
+
+  FRIEND_TEST_ALL_PREFIXES(MutationObserverTest, DisconnectCrash);
 };
 
 }  // namespace blink