CSS Animations: Fix crash where update isn't applied

third_party/WebKit/Source/core/animation/css/CSSAnimations.cpp

Index: third_party/WebKit/Source/core/animation/css/CSSAnimations.cpp
diff --git a/third_party/WebKit/Source/core/animation/css/CSSAnimations.cpp b/third_party/WebKit/Source/core/animation/css/CSSAnimations.cpp
index 9e9aa0903db57c5f66350dbc6bbc1a4e0922244a..2d4a718b681d45a359d7d9534d506f74311d69d0 100644
--- a/third_party/WebKit/Source/core/animation/css/CSSAnimations.cpp
+++ b/third_party/WebKit/Source/core/animation/css/CSSAnimations.cpp
@@ -365,15 +365,6 @@ void CSSAnimations::maybeApplyPendingUpdate(Element* element)
     // https://code.google.com/p/chromium/issues/detail?id=339847
     DisableCompositingQueryAsserts disabler;
 
-    const Vector<size_t>& cancelledIndices = m_pendingUpdate.cancelledAnimationIndices();
-    for (size_t i = cancelledIndices.size(); i-- > 0;) {
-        ASSERT(i == cancelledIndices.size() - 1 || cancelledIndices[i] < cancelledIndices[i + 1]);
-        Animation& animation = *m_runningAnimations[cancelledIndices[i]]->animation;
-        animation.cancel();
-        animation.update(TimingUpdateOnDemand);
-        m_runningAnimations.remove(cancelledIndices[i]);
-    }
-
     for (size_t pausedIndex : m_pendingUpdate.animationIndicesWithPauseToggled()) {
         Animation& animation = *m_runningAnimations[pausedIndex]->animation;
         if (animation.paused())
@@ -396,6 +387,15 @@ void CSSAnimations::maybeApplyPendingUpdate(Element* element)
         m_runningAnimations[entry.index]->update(entry);
     }
 
+    const Vector<size_t>& cancelledIndices = m_pendingUpdate.cancelledAnimationIndices();
+    for (size_t i = cancelledIndices.size(); i-- > 0;) {
+        ASSERT(i == cancelledIndices.size() - 1 || cancelledIndices[i] < cancelledIndices[i + 1]);
+        Animation& animation = *m_runningAnimations[cancelledIndices[i]]->animation;
+        animation.cancel();
+        animation.update(TimingUpdateOnDemand);
+        m_runningAnimations.remove(cancelledIndices[i]);
+    }
+
     for (const auto& entry : m_pendingUpdate.newAnimations()) {
         const InertEffect* inertAnimation = entry.effect.get();
         AnimationEventDelegate* eventDelegate = new AnimationEventDelegate(element, entry.name);