[SVG] Defer recursive detachAnimatedProperty call to avoid touching invalidated iterator

Source/core/svg/properties/SVGAnimatedProperty.cpp

Index: Source/core/svg/properties/SVGAnimatedProperty.cpp
diff --git a/Source/core/svg/properties/SVGAnimatedProperty.cpp b/Source/core/svg/properties/SVGAnimatedProperty.cpp
index 2258ad93f57ec028c6defd8dd123d7983db95770..b1e1e7835cdc6d546d5216195cdead1d12f713fc 100644
--- a/Source/core/svg/properties/SVGAnimatedProperty.cpp
+++ b/Source/core/svg/properties/SVGAnimatedProperty.cpp
@@ -56,8 +56,13 @@ void SVGAnimatedProperty::detachAnimatedPropertiesForElement(SVGElement* element
         }
     }
 
-    for (Vector<SVGAnimatedPropertyDescription>::const_iterator it = keysToRemove.begin(); it != keysToRemove.end(); ++it)
+    for (Vector<SVGAnimatedPropertyDescription>::const_iterator it = keysToRemove.begin(); it != keysToRemove.end(); ++it) {
+        // http://crbug.com/333156 :
+        // There are cases where detachAnimatedPropertiesForElement is called recursively from ~SVGAnimatedProperty.
+        // This below protect makes this function safe by deferring the recursive call until we finish touching the HashMap.
+        RefPtr<SVGAnimatedProperty> protect = cache->get(*it);
         cache->remove(*it);
+    }
 }
 
 void SVGAnimatedProperty::commitChange()