Merge 113378 - Crash in MutationObservers due to an invalid HashSet iterator

Source/WebCore/dom/MutationObserverRegistration.h

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 32 matching lines @@
 class MutationObserverRegistration {
 public:
 
     static PassOwnPtr<MutationObserverRegistration> create(PassRefPtr<WebKitMutationObserver>, Node*);
 
     ~MutationObserverRegistration();
 
     void resetObservation(MutationObserverOptions, const HashSet<AtomicString>& attributeFilter);
     void observedSubtreeNodeWillDetach(PassRefPtr<Node>);
     void clearTransientRegistrations();
+    bool hasTransientRegistrations() { return m_transientRegistrationNodes && !m_transientRegistrationNodes->isEmpty(); }
     void unregister();
 
     bool shouldReceiveMutationFrom(Node*, WebKitMutationObserver::MutationType, const AtomicString& attributeName);
     bool inline isSubtree() const { return m_options & WebKitMutationObserver::Subtree; }
 
     WebKitMutationObserver* observer() { return m_observer.get(); }
     MutationRecordDeliveryOptions deliveryOptions() const { return m_options & (WebKitMutationObserver::AttributeOldValue | WebKitMutationObserver::CharacterDataOldValue); }
     MutationObserverOptions mutationTypes() const { return m_options & WebKitMutationObserver::AllMutationTypes; }
 
 private:
     MutationObserverRegistration(PassRefPtr<WebKitMutationObserver>, Node*);
 
     const HashSet<AtomicString>& caseInsensitiveAttributeFilter();
 
     RefPtr<WebKitMutationObserver> m_observer;
     Node* m_registrationNode;
     RefPtr<Node> m_registrationNodeKeepAlive;
     typedef HashSet<RefPtr<Node> > NodeHashSet;
     OwnPtr<NodeHashSet> m_transientRegistrationNodes;
 
     MutationObserverOptions m_options;
     HashSet<AtomicString> m_attributeFilter;
 };
 
 } // namespace WebCore
 
 #endif // ENABLE(MUTATION_OBSERVERS)
 
 #endif // MutationObserverRegistration_h