Speculatively handle weak member clearing while creating iteration vector.

CSSFontSelector keeps a set of weakly referenced clients; when notifying
those the set is copied into a temporary heap vector before iterating.

Allocating that vector might potentially cause a GC, which in turn
could cause some of the weak references to be cleared. With the outcome
that the temporary vector will contain empty tail elements.

Speculatively check&handle that eventuality when iterating.

R=haraken
BUG=568173

Review URL: https://codereview.chromium.org/1642913002

Cr-Commit-Position: refs/heads/master@{#372112}

third_party/WebKit/Source/core/css/CSSFontSelector.cpp

@@ -83,8 +83,12 @@ void CSSFontSelector::dispatchInvalidationCallbacks()
 
     WillBeHeapVector<RawPtrWillBeMember<CSSFontSelectorClient>> clients;
     copyToVector(m_clients, clients);
-    for (size_t i = 0; i < clients.size(); ++i)
-        clients[i]->fontsNeedUpdate(this);
+    // TODO(sof): the null check is temporarily in place to speculatively address
+    // crbug.com/568173.
+    for (auto& client : clients) {
+        if (client)
+            client->fontsNeedUpdate(this);
+    }
 }
 
 void CSSFontSelector::fontFaceInvalidated()