Testcase for crbug.com/350907

Source/core/svg/graphics/SVGImageChromeClient.cpp

 /*
  * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 45 matching lines @@
 
 void SVGImageChromeClient::invalidateContentsAndRootView(const IntRect& r)
 {
     // If m_image->m_page is null, we're being destructed, don't fire changedInRect() in that case.
     if (m_image && m_image->imageObserver() && m_image->m_page)
         m_image->imageObserver()->changedInRect(m_image, r);
 }
 
 void SVGImageChromeClient::scheduleAnimation()
 {
-    // FIXME: This should not be called after chromeDestroyed, but
-    // crbug.com/350907 seems to indicate it can be. Adding this
-    // ASSERT until we have a LayoutTest to reproduce this!
-    ASSERT(m_image);
+    // m_image can be 0 here when the SVGImage is (invalid and) destroyed -
+    // deferring destruction of it's Page, and said page contains a plugin and
+    // a marquee (or presumably other entity that schedules animations using
+    // the ScriptedAnimationController). The core issue is of course the
+    // deferred destruction since it creates this race window in the first
+    // place. (Relevant test: svg/as-image/svg-invalid-image-1.html)
     if (!m_image)
         return;
     // Because a single SVGImage can be shared by multiple pages, we can't key
     // our svg image layout on the page's real animation frame. Therefore, we
     // run this fake animation timer to trigger layout in SVGImages. The name,
     // "animationTimer", is to match the new requestAnimationFrame-based layout
     // approach.
     if (m_animationTimer.isActive())
         return;
     // Schedule the 'animation' ASAP if the image does not contain any
     // animations, but prefer a fixed, jittery, frame-delay if there're any
     // animations. Checking for pending/active animations could be more
     // stringent.
     double fireTime = m_image->hasAnimations() ? animationFrameDelay : 0;
     m_animationTimer.startOneShot(fireTime, FROM_HERE);
 }
 
 void SVGImageChromeClient::animationTimerFired(Timer<SVGImageChromeClient>*)
 {
     // In principle, we should call requestAnimationFrame callbacks here, but
     // we know there aren't any because script is forbidden inside SVGImages.
     if (m_image) {
         m_image->frameView()->page()->animator().serviceScriptedAnimations(currentTime());
         m_image->frameView()->updateLayoutAndStyleIfNeededRecursive();
     }
 }
 
 }