Merge 113378 - Crash in MutationObservers due to an invalid HashSet iterator

Source/WebCore/dom/WebKitMutationObserver.h

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 65 matching lines @@
     static PassRefPtr<WebKitMutationObserver> create(PassRefPtr<MutationCallback>);
     static void deliverAllMutations();
 
     ~WebKitMutationObserver();
 
     void observe(Node*, MutationObserverOptions, const HashSet<AtomicString>& attributeFilter, ExceptionCode&);
     void disconnect();
     void observationStarted(MutationObserverRegistration*);
     void observationEnded(MutationObserverRegistration*);
     void enqueueMutationRecord(PassRefPtr<MutationRecord>);
+    void setHasTransientRegistration();
 
 private:
     struct ObserverLessThan;
 
     WebKitMutationObserver(PassRefPtr<MutationCallback>);
     void deliver();
 
     static bool validateOptions(MutationObserverOptions);
 
     RefPtr<MutationCallback> m_callback;
     Vector<RefPtr<MutationRecord> > m_records;
     HashSet<MutationObserverRegistration*> m_registrations;
     unsigned m_priority;
 };
 
 }
 
 #endif // ENABLE(MUTATION_OBSERVERS)
 
 #endif // WebKitMutationObserver_h