Code:  void HTMLImportsController::Dispose() {
  for (const auto& loader : loaders_)
    loader->Dispose();
  loaders_.clear();
 
   if (root_) {
     root_->Dispose();
    root_.Clear();
  }
}

Vulnerability Type: 
CWE ID: CWE-416
Summary: Use after free in HTMLImportsController in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Commit Message: Speculative fix for crashes in HTMLImportsController::Dispose().

Copy the loaders_ vector before iterating it.
This CL has no tests because we don't know stable reproduction.

Bug: 843151
Change-Id: I3d5e184657cbce56dcfca0c717d7a0c464e20efe
Reviewed-on: https://chromium-review.googlesource.com/1245017
Reviewed-by: Keishi Hattori <keishi@chromium.org>
Commit-Queue: Kent Tamura <tkent@chromium.org>
Cr-Commit-Position: refs/heads/master@{#594226}