Fix crash due to unexpected Node deletion during MutationObserver registration book-keeping

Source/core/dom/Node.cpp

Index: Source/core/dom/Node.cpp
diff --git a/Source/core/dom/Node.cpp b/Source/core/dom/Node.cpp
index c970b388b6136f35682a593200c75701752e03be..d165760f089b6a69d55d8ef0a625350fbdebd8d5 100644
--- a/Source/core/dom/Node.cpp
+++ b/Source/core/dom/Node.cpp
@@ -2278,6 +2278,10 @@ void Node::unregisterMutationObserver(MutationObserverRegistration* registration
     if (index == notFound)
         return;
 
+    // Deleting the registration may cause this node to be derefed, so we must make sure the Vector operation completes
+    // before that, in case |this| is destroyed (see MutationObserverRegistration::m_registrationNodeKeepAlive).
+    // FIXME: Simplify the registration/transient registration logic to make this understandable by humans.
+    RefPtr<Node> protect(this);
     registry->remove(index);
 }