Lock animated property type of result animation during processing

third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp

 /*
  * Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2006 Rob Buis <buis@kde.org>
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 268 matching lines @@
     // If the target element has instances, update them as well, w/o requiring the <use> tree to be rebuilt.
     for (SVGElement* element : targetElement->instancesForElement())
         notifyTargetAboutAnimValChange(element, attributeName);
 }
 
 void SVGAnimateElement::clearAnimatedType()
 {
     if (!m_animatedProperty)
         return;
 
+    // The animated property lock is held for the "result animation" (see SMILTimeContainer::updateAnimations())
+    // while we're processing an animation group. We will very likely crash later if we clear the animated type
+    // while the lock is held. See crbug.com/581546.
+    RELEASE_ASSERT(!animatedTypeIsLocked());
+
     SVGElement* targetElement = this->targetElement();
     if (!targetElement) {
         m_animatedProperty.clear();
         return;
     }
 
     ShouldApplyAnimationType shouldApply = shouldApplyAnimation(targetElement, attributeName());
     if (shouldApply == ApplyXMLandCSSAnimation) {
         removeCSSPropertyFromTargetAndInstances(targetElement, attributeName());
     } else if (m_animator.isAnimatingCSSProperty()) {
@@ skipping 101 matching lines @@
 {
     visitor->trace(m_fromProperty);
     visitor->trace(m_toProperty);
     visitor->trace(m_toAtEndOfDurationProperty);
     visitor->trace(m_animatedProperty);
     visitor->trace(m_animator);
     SVGAnimationElement::trace(visitor);
 }
 
 } // namespace blink