Lock animated property type of result animation during processing

third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp

Index: third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp
diff --git a/third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp b/third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp
index 6429c840440def0edeac06af55d24b1fc7145d30..072c98a5a4248ece8ce41ba61ed05f939cddf049 100644
--- a/third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp
@@ -286,6 +286,11 @@ void SVGAnimateElement::clearAnimatedType()
     if (!m_animatedProperty)
         return;
 
+    // The animated property lock is held while we're a result
+    // animation for a animation group. We will very likely crash
+    // later if we clear the animated type while the lock is held.
+    RELEASE_ASSERT(!m_animatedPropertyLocked);
+
     SVGElement* targetElement = this->targetElement();
     if (!targetElement) {
         m_animatedProperty.clear();