Safely finalize an AnimationTimeline's still-attached Animations.

third_party/WebKit/Source/core/animation/Animation.cpp

Index: third_party/WebKit/Source/core/animation/Animation.cpp
diff --git a/third_party/WebKit/Source/core/animation/Animation.cpp b/third_party/WebKit/Source/core/animation/Animation.cpp
index f15ce8ee4ae1ab392292d87af62f7682b28c3a65..985b41151db54ba31ce2ccaa771227da22ad75ac 100644
--- a/third_party/WebKit/Source/core/animation/Animation.cpp
+++ b/third_party/WebKit/Source/core/animation/Animation.cpp
@@ -114,6 +114,15 @@ Animation::~Animation()
     destroyCompositorPlayer();
 }
 
+void Animation::dispose()
+{
+    destroyCompositorPlayer();
+    // If the AnimationTimeline and its Animation objects are
+    // finalized by the same GC, we have to eagerly clear out
+    // this Animation object's compositor player registration.
+    ASSERT(!m_compositorPlayer);
+}
+
 double Animation::effectEnd() const
 {
     return m_content ? m_content->endTimeInternal() : 0;
@@ -929,8 +938,8 @@ void Animation::destroyCompositorPlayer()
     if (m_compositorPlayer) {
         detachCompositorTimeline();
         m_compositorPlayer->setAnimationDelegate(nullptr);
+        m_compositorPlayer.clear();
     }
-    m_compositorPlayer.clear();
 }
 
 void Animation::attachCompositorTimeline()