LibWeb: Unregister IntersectionObserver from registration document

Before this change, there was some confusion possible where an IO would
try to find its way back to the document where we registered it.
This led to an assertion failure in the test I'm adding in the next
commit, so let's fix this first.

IOs now (weakly) remember the document where they are registered, and
only unregister from there.

Userland/Libraries/LibWeb/IntersectionObserver/IntersectionObserver.cpp

@@ -53,17 +53,17 @@ IntersectionObserver::IntersectionObserver(JS::Realm& realm, JS::GCPtr<WebIDL::C
     , m_thresholds(move(thresholds))
 {
     intersection_root().visit([this](auto& node) {
-        node->document().register_intersection_observer({}, *this);
+        m_document = node->document();
     });
+    m_document->register_intersection_observer({}, *this);
 }
 
 IntersectionObserver::~IntersectionObserver() = default;
 
 void IntersectionObserver::finalize()
 {
-    intersection_root().visit([this](auto& node) {
-        node->document().unregister_intersection_observer({}, *this);
-    });
+    if (m_document)
+        m_document->unregister_intersection_observer({}, *this);
 }
 
 void IntersectionObserver::initialize(JS::Realm& realm)

Userland/Libraries/LibWeb/IntersectionObserver/IntersectionObserver.h

@@ -83,6 +83,9 @@ private:
 
     // https://www.w3.org/TR/intersection-observer/#dom-intersectionobserver-observationtargets-slot
     Vector<JS::NonnullGCPtr<DOM::Element>> m_observation_targets;
+
+    // AD-HOC: This is the document where we've registered the IntersectionObserver.
+    WeakPtr<DOM::Document> m_document;
 };
 
 }