Oilpan: KeyframeEffect::m_target shouldn't become stale

Source/core/animation/ElementAnimations.cpp

Index: Source/core/animation/ElementAnimations.cpp
diff --git a/Source/core/animation/ElementAnimations.cpp b/Source/core/animation/ElementAnimations.cpp
index 9124dc603f8cc824a0472eb3fccb25c9c9330e58..1eb885958f8b1a1ca828c6cf4d7a7b19cccea473 100644
--- a/Source/core/animation/ElementAnimations.cpp
+++ b/Source/core/animation/ElementAnimations.cpp
@@ -42,6 +42,11 @@ ElementAnimations::ElementAnimations()
 
 ElementAnimations::~ElementAnimations()
 {
+#if !ENABLE(OILPAN)
+    for (KeyframeEffect* effect : m_effects)

[sof, 2015/09/03 05:21:46]

Aren't you touching a heap object here?

And how are notifyElementDestroyed() notifications handled for weakly held
objects that are destructed in GCs prior to their ElementAnimations-registered
object?

+        effect->notifyElementDestroyed();
+    m_effects.clear();
+#endif
 }
 
 void ElementAnimations::updateAnimationFlags(ComputedStyle& style)
@@ -88,6 +93,9 @@ DEFINE_TRACE(ElementAnimations)
     visitor->trace(m_cssAnimations);
     visitor->trace(m_defaultStack);
     visitor->trace(m_animations);
+#if !ENABLE(OILPAN)
+    visitor->trace(m_effects);
+#endif
 }
 
 const ComputedStyle* ElementAnimations::baseComputedStyle() const