Safely finalize an AnimationTimeline's still-attached Animations.

third_party/WebKit/Source/core/animation/AnimationTimeline.cpp

Index: third_party/WebKit/Source/core/animation/AnimationTimeline.cpp
diff --git a/third_party/WebKit/Source/core/animation/AnimationTimeline.cpp b/third_party/WebKit/Source/core/animation/AnimationTimeline.cpp
index 14882ee5cee826d20c1119988f98d082b565882d..d39fd4b3aa9a53b9b7ad36e3529a523f86a20c13 100644
--- a/third_party/WebKit/Source/core/animation/AnimationTimeline.cpp
+++ b/third_party/WebKit/Source/core/animation/AnimationTimeline.cpp
@@ -72,6 +72,7 @@ AnimationTimeline::AnimationTimeline(Document* document, PlatformTiming* timing)
     , m_playbackRate(1)
     , m_lastCurrentTimeInternal(0)
 {
+    ThreadState::current()->registerPreFinalizer(this);
     if (!timing)
         m_timing = new AnimationTimelineTiming(this);
     else
@@ -89,6 +90,17 @@ AnimationTimeline::~AnimationTimeline()
 {
 }
 
+void AnimationTimeline::dispose()
+{
+    // The Animation objects depend on using this AnimationTimeline to
+    // unregister from its underlying compositor timeline. To arrange
+    // for that safely, this dispose() method will return first
+    // during prefinalization, notifying each Animation object of
+    // impending destruction.
+    for (const auto& animation : m_animations)
+        animation->dispose();
+}
+
 bool AnimationTimeline::isActive()
 {
     return m_document && m_document->page();