Safely finalize an AnimationTimeline's still-attached Animations.

third_party/WebKit/Source/core/animation/AnimationTimeline.cpp

Index: third_party/WebKit/Source/core/animation/AnimationTimeline.cpp
diff --git a/third_party/WebKit/Source/core/animation/AnimationTimeline.cpp b/third_party/WebKit/Source/core/animation/AnimationTimeline.cpp
index 14882ee5cee826d20c1119988f98d082b565882d..8edbd7f681ca38d829a713e9ca63153826a1967c 100644
--- a/third_party/WebKit/Source/core/animation/AnimationTimeline.cpp
+++ b/third_party/WebKit/Source/core/animation/AnimationTimeline.cpp
@@ -72,6 +72,9 @@ AnimationTimeline::AnimationTimeline(Document* document, PlatformTiming* timing)
     , m_playbackRate(1)
     , m_lastCurrentTimeInternal(0)
 {
+#if ENABLE(OILPAN)
+    ThreadState::current()->registerPreFinalizer(this);
+#endif
     if (!timing)
         m_timing = new AnimationTimelineTiming(this);
     else
@@ -89,6 +92,17 @@ AnimationTimeline::~AnimationTimeline()
 {
 }
 
+void AnimationTimeline::dispose()
+{
+    // The Animation objects depend on using this AnimationTimeline to
+    // unregister from its underlying compositor timeline. To arrange
+    // for that safely, this dispose() method will return first
+    // during prefinalization, notifying each Animation object of
+    // impending destruction.

[haraken, 2015/12/09 14:02:04]

Why can't we add a pre-finalizer on Animation? The pre-finalizer should be able
to access the AnimationTimeline safely.

[sof, 2015/12/09 14:04:33]

There's many more of these.

+    for (const auto& animation : m_animations)
+        animation->dispose();
+}
+
 bool AnimationTimeline::isActive()
 {
     return m_document && m_document->page();