CSS Animations: Fix crash where update isn't applied

third_party/WebKit/Source/core/animation/css/CSSAnimations.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 347 matching lines @@
     if (m_pendingUpdate.isEmpty())
         return;
 
     m_previousActiveInterpolationsForAnimations.swap(m_pendingUpdate.activeInterpolationsForAnimations());
 
     // FIXME: cancelling, pausing, unpausing animations all query compositingState, which is not necessarily up to date here
     // since we call this from recalc style.
     // https://code.google.com/p/chromium/issues/detail?id=339847
     DisableCompositingQueryAsserts disabler;
 
-    const Vector<size_t>& cancelledIndices = m_pendingUpdate.cancelledAnimationIndices();
-    for (size_t i = cancelledIndices.size(); i-- > 0;) {
-        ASSERT(i == cancelledIndices.size() - 1 || cancelledIndices[i] < cancelledIndices[i + 1]);
-        Animation& animation = *m_runningAnimations[cancelledIndices[i]]->animation;
-        animation.cancel();
-        animation.update(TimingUpdateOnDemand);
-        m_runningAnimations.remove(cancelledIndices[i]);
-    }
-
     for (size_t pausedIndex : m_pendingUpdate.animationIndicesWithPauseToggled()) {
         Animation& animation = *m_runningAnimations[pausedIndex]->animation;
         if (animation.paused())
             animation.unpause();
         else
             animation.pause();
         if (animation.outdated())
             animation.update(TimingUpdateOnDemand);
     }
 
     for (const auto& animation : m_pendingUpdate.updatedCompositorKeyframes())
         animation->setCompositorPending(true);
 
     for (const auto& entry : m_pendingUpdate.animationsWithUpdates()) {
         KeyframeEffect* effect = toKeyframeEffect(entry.animation->effect());
 
         effect->setModel(entry.effect->model());
         effect->updateSpecifiedTiming(entry.effect->specifiedTiming());
 
         m_runningAnimations[entry.index]->update(entry);
     }
 
+    const Vector<size_t>& cancelledIndices = m_pendingUpdate.cancelledAnimationIndices();
+    for (size_t i = cancelledIndices.size(); i-- > 0;) {
+        ASSERT(i == cancelledIndices.size() - 1 || cancelledIndices[i] < cancelledIndices[i + 1]);
+        Animation& animation = *m_runningAnimations[cancelledIndices[i]]->animation;
+        animation.cancel();
+        animation.update(TimingUpdateOnDemand);
+        m_runningAnimations.remove(cancelledIndices[i]);
+    }
+
     for (const auto& entry : m_pendingUpdate.newAnimations()) {
         const InertEffect* inertAnimation = entry.effect.get();
         AnimationEventDelegate* eventDelegate = new AnimationEventDelegate(element, entry.name);
         KeyframeEffect* effect = KeyframeEffect::create(element, inertAnimation->model(), inertAnimation->specifiedTiming(), KeyframeEffect::DefaultPriority, eventDelegate);
         effect->setName(inertAnimation->name());
         Animation* animation = element->document().timeline().play(effect);
         if (inertAnimation->paused())
             animation->pause();
         animation->update(TimingUpdateOnDemand);
 
@@ skipping 429 matching lines @@
 }
 
 DEFINE_TRACE(CSSAnimations)
 {
     visitor->trace(m_transitions);
     visitor->trace(m_pendingUpdate);
     visitor->trace(m_runningAnimations);
 }
 
 } // namespace blink