Oilpan: KeyframeEffect::m_target shouldn't become stale

Source/core/animation/ElementAnimations.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 24 matching lines @@
 
 namespace blink {
 
 ElementAnimations::ElementAnimations()
     : m_animationStyleChange(false)
 {
 }
 
 ElementAnimations::~ElementAnimations()
 {
+#if !ENABLE(OILPAN)
+    for (KeyframeEffect* effect : m_effects)

[sof, 2015/09/03 05:21:46]

Aren't you touching a heap object here?

And how are notifyElementDestroyed() notifications handled for weakly held
objects that are destructed in GCs prior to their ElementAnimations-registered
object?

+        effect->notifyElementDestroyed();
+    m_effects.clear();
+#endif
 }
 
 void ElementAnimations::updateAnimationFlags(ComputedStyle& style)
 {
     for (const auto& entry : m_animations) {
         const Animation& animation = *entry.key;
         ASSERT(animation.effect());
         // FIXME: Needs to consider AnimationGroup once added.
         ASSERT(animation.effect()->isAnimation());
         const KeyframeEffect& effect = *toKeyframeEffect(animation.effect());
@@ skipping 26 matching lines @@
 {
     for (const auto& entry : m_animations)
         entry.key->restartAnimationOnCompositor();
 }
 
 DEFINE_TRACE(ElementAnimations)
 {
     visitor->trace(m_cssAnimations);
     visitor->trace(m_defaultStack);
     visitor->trace(m_animations);
+#if !ENABLE(OILPAN)
+    visitor->trace(m_effects);
+#endif
 }
 
 const ComputedStyle* ElementAnimations::baseComputedStyle() const
 {
 #if !ENABLE(ASSERT)
     if (isAnimationStyleChange())
         return m_baseComputedStyle.get();
 #endif
     return nullptr;
 }
@@ skipping 21 matching lines @@
     // TODO(rune@opera.com): The FontFaceCache version number may be increased without forcing
     // a style recalc (see crbug.com/471079). ComputedStyle objects created with different cache
     // versions will not be considered equal as Font::operator== will compare versions, hence
     // ComputedStyle::operator== will return false. We avoid using baseComputedStyle (the check for
     // isFallbackValid()) in that case to avoid triggering the ComputedStyle comparison ASSERT
     // in updateBaseComputedStyle.
     return m_animationStyleChange && (!m_baseComputedStyle || m_baseComputedStyle->font().isFallbackValid());
 }
 
 } // namespace blink