Testcase for crbug.com/350907

Testcase for crbug.com/350907

Also replace the FIXME with an attempt at explaining why/when m_image
can be 0.

BUG=350907
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=169210

[fs, 2014-03-13 15:00:49]

This a TC for issue 350907, derived from the fuzzer-produced reproductions in
issues 351422 and 351410.

It seems the core issue is the deferred destruction (not surprisingly). It
however involves invalid SVGs which contain <object> and <marquee> - the former
to trigger the plugin-loading timer and the later to attempt to schedule an
animation using the ScriptedAnimationController...

[pdr., 2014-03-13 18:38:08]

On 2014/03/13 15:00:49, fs wrote:
> This a TC for issue 350907, derived from the fuzzer-produced reproductions in
> issues 351422 and 351410.
> 
> It seems the core issue is the deferred destruction (not surprisingly). It
> however involves invalid SVGs which contain <object> and <marquee> - the
former
> to trigger the plugin-loading timer and the later to attempt to schedule an
> animation using the ScriptedAnimationController...

LGTM

[pdr., 2014-03-13 18:38:12]

The CQ bit was checked by pdr@chromium.org

[commit-bot: I haz the power, 2014-03-13 18:38:23]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/fs@opera.com/198943004/1

[commit-bot: I haz the power, 2014-03-14 03:33:59]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/fs@opera.com/198943004/1

[commit-bot: I haz the power, 2014-03-14 05:31:04]

Change committed as 169210

[eseidel, 2014-03-14 06:35:06]

I thought we were reverting all the deferred page-destruction stuff?

[eseidel, 2014-03-14 06:35:37]

Thank you for the test, btw.

[Mads Ager (chromium), 2014-03-14 07:24:44]

On 2014/03/14 06:35:06, eseidel wrote:
> I thought we were reverting all the deferred page-destruction stuff?

Yeah, we are going to revert that. I'll send out the revert today and I'll
revert the cpp part of this change as well. It is great to have this test case
though; it will help us catch potential finalization order issue for oilpan, so
thanks a lot for the test!