NetworkStateNotifier: also remove NetworkStateObserver in finalizer too

third_party/WebKit/Source/core/dom/Document.cpp

Index: third_party/WebKit/Source/core/dom/Document.cpp
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index b8178d8ac6d4d502ab047f41ed3a26978f8b2146..f6ba54b11142f3301bc8effd0e49d76e6df872e2 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -406,10 +406,11 @@ static void recordLoadReasonToHistogram(WouldLoadReason reason) {
 }
 
 class Document::NetworkStateObserver final
-    : public GarbageCollected<Document::NetworkStateObserver>,
+    : public GarbageCollectedFinalized<Document::NetworkStateObserver>,
       public NetworkStateNotifier::NetworkStateObserver,
       public ContextLifecycleObserver {
   USING_GARBAGE_COLLECTED_MIXIN(Document::NetworkStateObserver);
+  EAGERLY_FINALIZE();
 
  public:
   explicit NetworkStateObserver(Document& document)
@@ -419,6 +420,9 @@ class Document::NetworkStateObserver final
         TaskRunnerHelper::get(TaskType::Networking, getExecutionContext()));
   }
 
+  // We eagerly finalize, so it's safe to touch getExecutionContext() here.
+  ~NetworkStateObserver() { unregisterAsObserver(getExecutionContext()); }
+
   void onLineStateChange(bool onLine) override {
     AtomicString eventName =
         onLine ? EventTypeNames::online : EventTypeNames::offline;
@@ -430,6 +434,12 @@ class Document::NetworkStateObserver final
   }
 
   void contextDestroyed(ExecutionContext* context) override {
+    unregisterAsObserver(context);
+  }
+
+  void unregisterAsObserver(ExecutionContext* context) {
+    if (!context)
+      return;
     networkStateNotifier().removeOnLineObserver(
         this, TaskRunnerHelper::get(TaskType::Networking, context));
   }