Oilpan: KeyframeEffect::m_target shouldn't become stale

Source/core/animation/ElementAnimations.cpp

Index: Source/core/animation/ElementAnimations.cpp
diff --git a/Source/core/animation/ElementAnimations.cpp b/Source/core/animation/ElementAnimations.cpp
index 195b4fa0fa133479673be576efc42b21a279444d..68ee7970f3be7c0d3066c14d02805d59fbd88bd3 100644
--- a/Source/core/animation/ElementAnimations.cpp
+++ b/Source/core/animation/ElementAnimations.cpp
@@ -42,7 +42,23 @@ ElementAnimations::ElementAnimations()
 
 ElementAnimations::~ElementAnimations()
 {
+#if !ENABLE(OILPAN)
+    ASSERT(m_effects.isEmpty());
+#endif
+}
+
+#if !ENABLE(OILPAN)
+void ElementAnimations::dispose()
+{
+    // The notifyElementDestroyed() is called for elements that happen to live
+    // longer than the KeyframeEffect. This undeterminism is fine because
+    // all the notifyElementDestroyed() does is to clear the raw pointers
+    // held by the KeyframeEffect.
+    for (KeyframeEffect* effect : m_effects)
+        effect->notifyElementDestroyed();
+    m_effects.clear();
 }
+#endif
 
 void ElementAnimations::updateAnimationFlags(ComputedStyle& style)
 {
@@ -88,6 +104,9 @@ DEFINE_TRACE(ElementAnimations)
     visitor->trace(m_cssAnimations);
     visitor->trace(m_defaultStack);
     visitor->trace(m_animations);
+#if !ENABLE(OILPAN)
+    visitor->trace(m_effects);
+#endif
 }
 
 const ComputedStyle* ElementAnimations::baseComputedStyle() const