Oilpan: ImageObserver needs to be a GC mixin.

third_party/WebKit/Source/core/svg/graphics/SVGImageChromeClient.cpp

 /*
  * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 69 matching lines @@
     // animations. Checking for pending/active animations could be more
     // stringent.
     double fireTime = m_image->hasAnimations() ? animationFrameDelay : 0;
     m_animationTimer.startOneShot(fireTime, BLINK_FROM_HERE);
 }
 
 void SVGImageChromeClient::animationTimerFired(Timer<SVGImageChromeClient>*)
 {
     if (!m_image)
         return;
+
+#if ENABLE(OILPAN)
+    // The SVGImageChromeClient object's lifetime is dependent on
+    // the ImageObserver (an ImageResource) of its image. Should it
+    // be dead and about to be lazily swept out, do not proceed.
+    //
+    // TODO(Oilpan): move (SVG)Image to the Oilpan heap, and avoid
+    // this explicit lifetime check.
+    if (Heap::willObjectBeLazilySwept(m_image->imageObserver()))

[haraken, 2016/02/11 13:25:19]

Can we avoid using Heap::willObjectBeLazilySwept by using a pre-finalizer?

[sof, 2016/02/11 13:27:41]

ImageLoader already is, so it gets complex if ImageResource should be also. And
there'll be quite a few of them.

[haraken, 2016/02/11 13:49:40]

Would it be possible to make SVGImageChromeClient (or Image?) hold a
WeakPersistent to the ImageObserver?

+        return;
+#endif
+
     // serviceScriptedAnimations runs requestAnimationFrame callbacks, but SVG
     // images can't have any so we assert there's no script.
     ScriptForbiddenScope forbidScript;
 
-    // As neither SVGImage nor this chrome client object are on the Oilpan heap,
-    // this object's reference to the SVGImage will not be traced should a GC
-    // strike below. Hence, we must ensure that they both remain alive for
-    // duration of this call.
-    //
-    // This is cannot arise non-Oilpan as an ImageResource is an owned object
-    // and will be promptly released along with its (SVG)Image..and everything
-    // below, including this object and its timer. For code simplicity, the
-    // object protection isn't made the conditional on Oilpan.
-    //
-    // TODO(oilpan): move SVGImage to the Oilpan heap and remove this protection.
-    RefPtr<SVGImage> protect(m_image);
+    // The calls below may trigger GCs, so set up the required persistent
+    // reference on the ImageResource which owns this SVGImage. By transitivity,
+    // that will keep this SVGImageChromeClient object alive.
+    RawPtrWillBePersistent<ImageObserver> protect(m_image->imageObserver());
     m_image->frameView()->page()->animator().serviceScriptedAnimations(monotonicallyIncreasingTime());
     m_image->frameView()->updateAllLifecyclePhases();
 }
 
 } // namespace blink