Unregister AnimationPlayer from ActiveDOMObjects on timeline deletion.

Source/core/animation/AnimationTimeline.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 59 matching lines @@
     if (!timing)
         m_timing = adoptPtrWillBeNoop(new AnimationTimelineTiming(this));
     else
         m_timing = timing;
 
     ASSERT(document);
 }
 
 AnimationTimeline::~AnimationTimeline()
 {
+    for (const auto& player : m_players)

[sof, 2015/04/10 09:12:52]

Why are their two loops over m_players here (and dispose() first)?

Accessing other heap objects (AnimationPlayer and the hash set) is not allowed
from within dtors with Oilpan -- finalization isn't ordered.

[loyso (OOO), 2015/04/13 00:05:16]

Nice to know from now! Sorry and thanks, sof!

+        player->dispose();

[dstockwell, 2015/04/10 11:21:34]

Hmm, this should probably just move to player->timelineDestroyed() The player
should die together with it's timeline under Oilpan.

But, thinking about this patch more, we should just make setCompositorPending
early out when timeline is null.

If this is causing problems for Oilpan it's fine to just revert this patch.

+
 #if !ENABLE(OILPAN)
     for (const auto& player : m_players)
         player->timelineDestroyed();
 #endif
 }
 
 void AnimationTimeline::playerAttached(AnimationPlayer& player)
 {
     ASSERT(player.timeline() == this);
     ASSERT(!m_players.contains(&player));
@@ skipping 222 matching lines @@
 {
 #if ENABLE(OILPAN)
     visitor->trace(m_document);
     visitor->trace(m_timing);
     visitor->trace(m_playersNeedingUpdate);
     visitor->trace(m_players);
 #endif
 }
 
 } // namespace