Do not invoke async method on a GC-unreachable object.

Source/platform/AsyncMethodRunner.h

Index: Source/platform/AsyncMethodRunner.h
diff --git a/Source/platform/AsyncMethodRunner.h b/Source/platform/AsyncMethodRunner.h
index 41201d131ad19c46a1f66d799023da7a1b3ab0ed..a496b53832b60fd04af01fcfe60e1a6269844891 100644
--- a/Source/platform/AsyncMethodRunner.h
+++ b/Source/platform/AsyncMethodRunner.h
@@ -120,11 +120,18 @@ public:
     }
 
 private:
-    void fired(Timer<AsyncMethodRunner<TargetClass>>*) { (m_object->*m_method)(); }
+    void fired(Timer<AsyncMethodRunner<TargetClass>>*)
+    {
+        // TODO(Oilpan): when AsyncMethodRunner is on the heap, this check becomes
+        // redundant; handled directly by Timer<> instead.
+        if (!TimerIsObjectAliveTrait<TargetClass>::isHeapObjectAlive(m_object))
+            return;
+        (m_object->*m_method)();
+    }
 
     Timer<AsyncMethodRunner<TargetClass>> m_timer;
 
-    // FIXME: oilpan: AsyncMethodRunner should be moved to the heap and m_object should be traced.
+    // TODO(Oilpan): AsyncMethodRunner should be moved to the heap and m_object should be traced.
     // This raw pointer is safe as long as AsyncMethodRunner<X> is held by the X itself
     // (That's the case in the current code base).
     GC_PLUGIN_IGNORE("363031")