Paper over a recent null-ptr crash regression in SVGImage

Source/core/svg/graphics/SVGImageChromeClient.cpp

Index: Source/core/svg/graphics/SVGImageChromeClient.cpp
diff --git a/Source/core/svg/graphics/SVGImageChromeClient.cpp b/Source/core/svg/graphics/SVGImageChromeClient.cpp
index 54045c01b50d843410fdb627d97b577ef4303b7b..b85338301f7218577e07ad01bfc4a5d356b56b54 100644
--- a/Source/core/svg/graphics/SVGImageChromeClient.cpp
+++ b/Source/core/svg/graphics/SVGImageChromeClient.cpp
@@ -63,6 +63,12 @@ void SVGImageChromeClient::invalidateContentsAndRootView(const IntRect& r)
 
 void SVGImageChromeClient::scheduleAnimation()
 {
+    // FIXME: This should not be called after chromeDestroyed, but
+    // crbug.com/350907 seems to indicate it can be. Adding this
+    // ASSERT until we have a LayoutTest to reproduce this!
+    ASSERT(m_image);
+    if (!m_image)
+        return;
     // Because a single SVGImage can be shared by multiple pages, we can't key
     // our svg image layout on the page's real animation frame. Therefore, we
     // run this fake animation timer to trigger layout in SVGImages. The name,