Merge 113378 - Crash in MutationObservers due to an invalid HashSet iterator

Source/WebCore/dom/WebKitMutationObserver.cpp

Index: Source/WebCore/dom/WebKitMutationObserver.cpp
===================================================================
--- Source/WebCore/dom/WebKitMutationObserver.cpp	(revision 113746)
+++ Source/WebCore/dom/WebKitMutationObserver.cpp	(working copy)
@@ -135,17 +135,30 @@
     activeMutationObservers().add(this);
 }
 
+void WebKitMutationObserver::setHasTransientRegistration()
+{
+    ASSERT(isMainThread());
+    activeMutationObservers().add(this);
+}
+
 void WebKitMutationObserver::deliver()
 {
+    // Calling clearTransientRegistrations() can modify m_registrations, so it's necessary
+    // to make a copy of the transient registrations before operating on them.
+    Vector<MutationObserverRegistration*, 1> transientRegistrations;
+    for (HashSet<MutationObserverRegistration*>::iterator iter = m_registrations.begin(); iter != m_registrations.end(); ++iter) {
+        if ((*iter)->hasTransientRegistrations())
+            transientRegistrations.append(*iter);
+    }
+    for (size_t i = 0; i < transientRegistrations.size(); ++i)
+        transientRegistrations[i]->clearTransientRegistrations();
+
     if (m_records.isEmpty())
         return;
 
     MutationRecordArray records;
     records.swap(m_records);
 
-    for (HashSet<MutationObserverRegistration*>::iterator iter = m_registrations.begin(); iter != m_registrations.end(); ++iter)
-        (*iter)->clearTransientRegistrations();
-
     m_callback->handleEvent(&records, this);
 }