Merge 113378 - Crash in MutationObservers due to an invalid HashSet iterator

Source/WebCore/dom/MutationObserverRegistration.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 53 matching lines @@
     m_options = options;
     m_attributeFilter = attributeFilter;
 }
 
 void MutationObserverRegistration::observedSubtreeNodeWillDetach(PassRefPtr<Node> node)
 {
     if (!isSubtree())
         return;
 
     node->registerTransientMutationObserver(this);
+    m_observer->setHasTransientRegistration();
 
     if (!m_transientRegistrationNodes) {
         m_transientRegistrationNodes = adoptPtr(new NodeHashSet);
 
         ASSERT(!m_registrationNodeKeepAlive);
         m_registrationNodeKeepAlive = m_registrationNode; // Balanced in clearTransientRegistrations.
     }
     m_transientRegistrationNodes->add(node);
 }
 
@@ skipping 29 matching lines @@
 
     if (type != WebKitMutationObserver::Attributes || !(m_options & WebKitMutationObserver::AttributeFilter))
         return true;
 
     return m_attributeFilter.contains(attributeName);
 }
 
 } // namespace WebCore
 
 #endif // ENABLE(MUTATION_OBSERVERS)