Unregister AnimationPlayer from ActiveDOMObjects on timeline deletion.

Source/core/animation/AnimationPlayer.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 595 matching lines @@
     return ActiveDOMObject::executionContext();
 }
 
 bool AnimationPlayer::hasPendingActivity() const
 {
     return m_pendingFinishedEvent || (!m_finished && hasEventListeners(EventTypeNames::finish));
 }
 
 void AnimationPlayer::stop()
 {
     PlayStateUpdateScope updateScope(*this, TimingUpdateOnDemand);

[loyso (OOO), 2015/04/02 02:52:07]

This implicitly sets CompositorPendingChange = SetCompositorPending.
AnimationPlayer's ActiveDOMObject::stop may be called AFTER it's parent
~AnimationTimeline() destroyed.

 
     m_finished = true;
     m_pendingFinishedEvent = nullptr;
 }
 
 bool AnimationPlayer::dispatchEvent(PassRefPtrWillBeRawPtr<Event> event)
 {
     if (m_pendingFinishedEvent == event)
         m_pendingFinishedEvent = nullptr;
     return EventTargetWithInlineData::dispatchEvent(event);
@@ skipping 78 matching lines @@
         m_compositorState->sourceChanged = true;
     }
     if (m_compositorPending || m_isPausedForTesting) {
         return;
     }
 
     if (sourceChanged || !m_compositorState
         || !playing() || m_compositorState->playbackRate != m_playbackRate
         || m_compositorState->startTime != m_startTime) {
         m_compositorPending = true;
+        ASSERT(timeline());
+        ASSERT(timeline()->document());
         timeline()->document()->compositorPendingAnimations().add(this);
     }
 }
 
 void AnimationPlayer::cancelAnimationOnCompositor()
 {
     if (hasActiveAnimationsOnCompositor())
         toAnimation(m_content.get())->cancelAnimationOnCompositor();
 }
 
@@ skipping 203 matching lines @@
     visitor->trace(m_content);
     visitor->trace(m_timeline);
     visitor->trace(m_pendingFinishedEvent);
     visitor->trace(m_finishedPromise);
     visitor->trace(m_readyPromise);
     EventTargetWithInlineData::trace(visitor);
     ActiveDOMObject::trace(visitor);
 }
 
 } // namespace