Oilpan: Delay frameDetached() so it won't dispatch event inside ~SVGImage

Source/core/svg/graphics/SVGImageChromeClient.h

 /*
  * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 22 matching lines @@
 #include "platform/Timer.h"
 
 namespace WebCore {
 
 class SVGImageChromeClient FINAL : public EmptyChromeClient {
     WTF_MAKE_NONCOPYABLE(SVGImageChromeClient); WTF_MAKE_FAST_ALLOCATED;
 public:
     explicit SVGImageChromeClient(SVGImage*);
     virtual bool isSVGImageChromeClient() const OVERRIDE;
 
+    void clearImage() { m_image = 0; }
     SVGImage* image() const { return m_image; }
 
 private:
     virtual void chromeDestroyed() OVERRIDE;
     virtual void invalidateContentsAndRootView(const IntRect&) OVERRIDE;
     virtual void scheduleAnimation() OVERRIDE;
 
     void animationTimerFired(Timer<SVGImageChromeClient>*);
 
     SVGImage* m_image;
     Timer<SVGImageChromeClient> m_animationTimer;
 };
 
 DEFINE_TYPE_CASTS(SVGImageChromeClient, ChromeClient, client, client->isSVGImageChromeClient(), client.isSVGImageChromeClient());
 
 }
 
 #endif // SVGImageChromeClient_h