Merge 113378 - Crash in MutationObservers due to an invalid HashSet iterator

Source/WebCore/dom/WebKitMutationObserver.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 117 matching lines @@
     return activeObservers;
 }
 
 void WebKitMutationObserver::enqueueMutationRecord(PassRefPtr<MutationRecord> mutation)
 {
     ASSERT(isMainThread());
     m_records.append(mutation);
     activeMutationObservers().add(this);
 }
 
+void WebKitMutationObserver::setHasTransientRegistration()
+{
+    ASSERT(isMainThread());
+    activeMutationObservers().add(this);
+}
+
 void WebKitMutationObserver::deliver()
 {
+    // Calling clearTransientRegistrations() can modify m_registrations, so it's necessary
+    // to make a copy of the transient registrations before operating on them.
+    Vector<MutationObserverRegistration*, 1> transientRegistrations;
+    for (HashSet<MutationObserverRegistration*>::iterator iter = m_registrations.begin(); iter != m_registrations.end(); ++iter) {
+        if ((*iter)->hasTransientRegistrations())
+            transientRegistrations.append(*iter);
+    }
+    for (size_t i = 0; i < transientRegistrations.size(); ++i)
+        transientRegistrations[i]->clearTransientRegistrations();
+
     if (m_records.isEmpty())
         return;
 
     MutationRecordArray records;
     records.swap(m_records);
 
-    for (HashSet<MutationObserverRegistration*>::iterator iter = m_registrations.begin(); iter != m_registrations.end(); ++iter)
-        (*iter)->clearTransientRegistrations();
-
     m_callback->handleEvent(&records, this);
 }
 
 void WebKitMutationObserver::deliverAllMutations()
 {
     ASSERT(isMainThread());
     static bool deliveryInProgress = false;
     if (deliveryInProgress)
         return;
     deliveryInProgress = true;
 
     while (!activeMutationObservers().isEmpty()) {
         Vector<RefPtr<WebKitMutationObserver> > observers;
         copyToVector(activeMutationObservers(), observers);
         activeMutationObservers().clear();
         std::sort(observers.begin(), observers.end(), ObserverLessThan());
         for (size_t i = 0; i < observers.size(); ++i)
             observers[i]->deliver();
     }
 
     deliveryInProgress = false;
 }
 
 } // namespace WebCore
 
 #endif // ENABLE(MUTATION_OBSERVERS)