Testcase for crbug.com/350907

Source/core/svg/graphics/SVGImageChromeClient.cpp

Index: Source/core/svg/graphics/SVGImageChromeClient.cpp
diff --git a/Source/core/svg/graphics/SVGImageChromeClient.cpp b/Source/core/svg/graphics/SVGImageChromeClient.cpp
index b85338301f7218577e07ad01bfc4a5d356b56b54..9903b2e06d858451b4f6ac50495cb1e73e9efeb0 100644
--- a/Source/core/svg/graphics/SVGImageChromeClient.cpp
+++ b/Source/core/svg/graphics/SVGImageChromeClient.cpp
@@ -63,10 +63,12 @@ void SVGImageChromeClient::invalidateContentsAndRootView(const IntRect& r)
 
 void SVGImageChromeClient::scheduleAnimation()
 {
-    // FIXME: This should not be called after chromeDestroyed, but
-    // crbug.com/350907 seems to indicate it can be. Adding this
-    // ASSERT until we have a LayoutTest to reproduce this!
-    ASSERT(m_image);
+    // m_image can be 0 here when the SVGImage is (invalid and) destroyed -
+    // deferring destruction of it's Page, and said page contains a plugin and
+    // a marquee (or presumably other entity that schedules animations using
+    // the ScriptedAnimationController). The core issue is of course the
+    // deferred destruction since it creates this race window in the first
+    // place. (Relevant test: svg/as-image/svg-invalid-image-1.html)
     if (!m_image)
         return;
     // Because a single SVGImage can be shared by multiple pages, we can't key