Merge 113378 - Crash in MutationObservers due to an invalid HashSet iterator

LayoutTests/fast/mutation/clear-transient-without-delivery.html

 <script src="../js/resources/js-test-pre.js"></script>
 <script>
 window.jsTestIsAsync = true;
 description('Transient registrations should be cleared even without delivery.');
 
 var mutationsDelivered = false;
 function callback(mutations) {
     mutationsDelivered = true;
 }
 var observer = new WebKitMutationObserver(callback);
 
 var div = document.createElement('div');
 var span = div.appendChild(document.createElement('span'));
 observer.observe(div, {attributes: true, subtree: true});
 div.removeChild(span);
 setTimeout(function() {
     // By the time this function runs the transient registration should be cleared,
     // so we expect not to be notified of this attribute mutation.
     span.setAttribute('bar', 'baz');
     setTimeout(function() {
         shouldBeFalse('mutationsDelivered');
         finishJSTest();
     }, 0);
 }, 0);
 </script>
 <script src="../js/resources/js-test-post.js"></script>